Carrier Frequency Offset (CFO)

CFO originates from the local oscillator (LO) , which is never perfectly tuned to the nominal carrier frequency. Manufacturing variances in crystal oscillators—typically specified in parts per million (ppm) —cause each device to transmit at a slightly offset frequency. A 10 MHz reference with a ±2 ppm tolerance can produce a CFO of up to 20 Hz at the carrier, creating a measurable and unique bias.

CFO is considered a quasi-stationary fingerprint. While stable over short observation windows, it exhibits slow drift due to:

• Temperature variation: Crystal frequency is temperature-dependent, shifting predictably with thermal changes.
• Component aging: Oscillator accuracy degrades over years, causing a gradual, monotonic frequency walk. This necessitates drift compensation algorithms that continuously update the CFO baseline to prevent false rejections in long-term deployments.

CFO is estimated during the receiver synchronization phase, typically by exploiting known preamble or pilot symbols. Common techniques include:

• Moose algorithm: Uses two identical training symbols to compute phase rotation in the time domain.
• Schmidl-Cox method: Employs a specially designed preamble with repetitive structure for joint timing and frequency offset estimation. The estimated CFO value, measured in Hz or as a normalized subcarrier offset, becomes the feature vector input for device classification.

CFO is a channel-independent feature, making it highly attractive for non-line-of-sight and mobile scenarios. Unlike IQ imbalance or power amplifier non-linearity, CFO is not distorted by multipath fading or shadowing. However, Doppler shift from relative motion between transmitter and receiver adds a velocity-dependent frequency offset that can mask the hardware CFO. Systems must compensate for Doppler or operate in static environments to isolate the device-intrinsic offset.

The uniqueness of CFO as a fingerprint depends on the oscillator tolerance distribution across a device population. In a batch of 1,000 devices with ±2 ppm oscillators, CFO values form a continuous distribution. While individual devices are separable with high-resolution estimation, the feature space is one-dimensional, limiting discriminability compared to multi-dimensional features like IQ imbalance or bispectrum coefficients. CFO is most effective when combined with other impairments in a composite feature vector.

CFO is a passive, observable feature that can be measured and replicated by a sophisticated adversary. A software-defined radio (SDR) attacker can estimate a legitimate device's CFO and apply a compensating frequency shift to mimic it. Countermeasures include:

• Multi-feature binding: Authenticating on CFO jointly with non-linear amplifier characteristics that are harder to clone.
• Challenge-response protocols: Requesting a frequency hop and verifying the relative offset between channels, which reveals the underlying oscillator's ppm error curve.

A mismatch between the transmitter's digital-to-analog converter (DAC) clock and the receiver's analog-to-digital converter (ADC) clock. While CFO is a frequency-domain error, SCO causes a slow drift in symbol timing that accumulates over a transmission burst. This timing wander manifests as a rotating constellation and is highly device-specific due to quartz crystal manufacturing tolerances. Together, CFO and SCO form the two primary oscillator-derived impairments used in steady-state fingerprinting.

A hardware impairment where the in-phase (I) and quadrature (Q) branches of a modulator have mismatched gain or are not perfectly orthogonal. This creates an asymmetric distortion in the transmitted constellation that is independent of frequency offset. Key characteristics include:

• Gain imbalance: Amplitude difference between I and Q paths
• Phase imbalance: Deviation from the ideal 90-degree separation
• Results in an elliptical constellation shape unique to each transmitter

Rapid, short-term random fluctuations in the phase of a signal originating from the same local oscillator that causes CFO. While CFO is the static frequency offset, phase noise is the dynamic, stochastic component that creates a distinctive spectral skirt around the carrier. This skirt shape is a powerful identifying feature because it reflects the unique phase-locked loop (PLL) dynamics and oscillator quality of each device.

Signal distortion caused by a transmitter's power amplifier (PA) operating near its saturation point. Characterized by:

• AM-AM distortion: Amplitude compression
• AM-PM distortion: Amplitude-dependent phase shift This non-linear behavior generates spectral regrowth into adjacent channels and creates unique constellation warping. Unlike CFO, which is an oscillator artifact, PA non-linearity originates in the final amplification stage and is highly sensitive to individual transistor characteristics.

A comprehensive, aggregate metric that quantifies the deviation of measured constellation points from their ideal reference positions. EVM captures the combined effect of CFO, I/Q imbalance, phase noise, and PA non-linearity into a single quality score. While EVM alone is not discriminative enough for device identification, it serves as a critical signal quality gate—excessively high EVM can mask the subtle individual impairments that fingerprinting algorithms rely on.

An impairment where a portion of the unmodulated carrier signal leaks through the mixer directly to the output. This creates a distinctive DC offset in the baseband constellation, also known as origin offset. The magnitude and phase of this leakage are unique to each device due to parasitic coupling and mixer imbalances. When combined with CFO, the leaked carrier appears as a static tone offset from the intended center frequency, providing a persistent and easily extractable fingerprint feature.