Carrier Frequency Offset (CFO)

The primary physical origin of CFO is the frequency synthesis error in a transmitter's local oscillator. Manufacturing variances in crystal oscillators and phase-locked loop (PLL) components cause each device to transmit at a slightly different carrier frequency than its nominal specification.

• Crystal tolerance: Typical quartz crystals have frequency tolerances of ±1 to ±20 parts per million (ppm), directly translating to a CFO of ±2.4 kHz at 2.4 GHz for a ±1 ppm crystal.
• Temperature dependence: Oscillator frequency drifts with temperature, typically following a cubic curve, creating a slow-varying CFO component.
• Aging effects: Crystal aging introduces long-term frequency drift, typically 1-5 ppm per year, requiring periodic recalibration of fingerprinting models.

In mobile scenarios, relative motion between transmitter and receiver introduces an additional frequency shift component that compounds with the static LO offset. The observed CFO becomes the sum of the hardware-induced offset and the kinematic Doppler shift.

• Doppler formula: f_d = (v/c) × f_c, where v is relative velocity, c is the speed of light, and f_c is the carrier frequency.
• Example: A vehicle moving at 30 m/s (108 km/h) at 2.4 GHz produces a Doppler shift of approximately 240 Hz.
• Separation challenge: Distinguishing the static hardware CFO from the dynamic Doppler component requires multi-frame estimation or inertial sensor fusion.

Accurate CFO extraction is essential for using it as a fingerprint. Common estimation methods leverage the periodic structure of communication waveforms or data-aided approaches.

• Cyclic Prefix (CP) correlation: In OFDM systems, the CP is a copy of the end of the symbol; correlating the CP with its source yields a phase rotation proportional to CFO.
• Preamble-based estimation: Known training sequences (e.g., 802.11 Short Training Field) enable precise CFO estimation through autocorrelation of repeated patterns.
• Blind estimation: Non-data-aided methods use higher-order statistics or cyclostationary analysis when preambles are unavailable.
• Cramér-Rao Lower Bound (CRLB): Defines the theoretical minimum variance of any unbiased CFO estimator, typically on the order of 10^-2 ppm for practical SNRs.

CFO is valued as an RF fingerprint because it exhibits high short-term stability while varying distinctly across devices. Unlike transient-based features, CFO is continuously observable throughout the entire transmission.

• Short-term variance: For a temperature-stabilized device, CFO typically varies by less than 0.01 ppm over minutes, providing a consistent identifier.
• Inter-device separability: Even within the same model line, manufacturing tolerances create CFO differences of 0.5–5 ppm between units, sufficient for discrimination.
• Complementary to I/Q imbalance: CFO is orthogonal to quadrature errors, meaning it adds independent discriminative power when combined with other impairments in a multi-dimensional fingerprint vector.

In synthetic RF impairment generation, CFO is modeled as a complex exponential multiplication applied to the baseband waveform. This enables the creation of large, labeled datasets for training deep learning fingerprinting models.

• Mathematical model: y[n] = x[n] × e^(j2πΔf nTs), where Δf is the CFO in Hz and Ts is the sampling period.
• Parameter sampling: CFO values are drawn from a Gaussian distribution centered at 0 Hz with a standard deviation matching real-world oscillator tolerances (e.g., σ = 5 ppm).
• Drift simulation: Slow time-varying CFO is modeled as a random walk or Ornstein-Uhlenbeck process to emulate thermal and aging effects.
• Domain randomization: Training across a wide range of synthetic CFO values forces the neural network to learn CFO-invariant features for other impairments, improving robustness.

Even after receiver-side CFO correction, a residual offset often remains due to estimation error and tracking loop lag. This residual can paradoxically serve as an even more unique fingerprint than the raw CFO.

• Correction mechanisms: Automatic frequency control (AFC) loops use feedback to continuously adjust a numerically controlled oscillator (NCO), but finite loop bandwidth leaves a tracking error.
• Residual signature: The dynamic pattern of the residual CFO over time—shaped by the AFC loop's transient response—is influenced by both the transmitter's LO and the receiver's own oscillator, creating a channel-relative fingerprint.
• Exploitation: Advanced fingerprinting systems can analyze the AFC correction signal itself as a feature, rather than the raw CFO, to capture device-specific loop dynamics.

A synthetic timing error representing the deviation between the transmitter's DAC and receiver's ADC clocks. While CFO corrupts the carrier frequency, SCO causes a slow drift in the optimal symbol sampling instant.

• Manifests as a linear phase rotation across subcarriers in OFDM systems
• Modeled in parts-per-million (ppm) relative to the nominal clock rate
• Combined with CFO to create a complete frequency-time impairment profile

The process of adding synthesized short-term frequency instability to a clean carrier. Unlike the static offset of CFO, phase noise is a dynamic, stochastic process modeled by a phase noise mask (dBc/Hz).

• Emulates local oscillator jitter and reciprocal mixing effects
• Characterized by a power-law spectrum with distinct regions (flicker, thermal)
• Creates a unique 'skirt' around the carrier that is highly device-specific

A time-varying frequency shift caused by relative motion between transmitter and receiver. While CFO is a static hardware bias, Doppler is a channel-induced dynamic offset.

• Modeled using the Jakes spectrum or a custom Doppler power spectral density
• Maximum shift calculated as f_d = (v/c) * f_c, where v is relative velocity
• Critical for distinguishing mobile emitters from stationary ones in fingerprinting models

The mathematical simulation of gain and phase mismatches between the in-phase and quadrature signal paths. This impairment creates an image of the signal spectrum that mirrors across the carrier frequency.

• Defined by amplitude imbalance (ε) in dB and phase imbalance (Δφ) in degrees
• Interacts with CFO to produce a distorted, rotated constellation
• A primary hardware fingerprint that is independent of frequency offset

The emulation of amplitude and phase distortion in a transmitter's final stage. Characterized by AM-AM and AM-PM conversion curves, this impairment causes spectral regrowth into adjacent channels.

• Modeled using memory polynomial or Volterra series for memory effects
• Creates compression at the constellation peaks, distinct from CFO's rotational effect
• Combined impairments produce a rich, multi-dimensional fingerprint space

A synthetic impairment representing the unintended radiation of the mixer's unmodulated carrier. This manifests as a DC offset in the transmitted I/Q constellation—a fixed displacement of the origin.

• Caused by finite isolation in the mixer's LO-RF port
• Appears as an unmodulated tone at the carrier frequency in the spectrum
• Provides a stable, persistent feature orthogonal to CFO for device identification