Fall-Time Variance

Fall-time variance is the statistical distribution of the measured 90% to 10% amplitude fall time across multiple burst transmissions from the same device. The measurement protocol captures the precise interval between the signal envelope crossing the 90% and 10% thresholds of its steady-state amplitude during the turn-off transient. Unlike a single fall-time value, the variance captures the stochastic nature of the discharge process, reflecting minute inconsistencies in the transmitter's power supply holdup capacitance, parasitic discharge paths, and semiconductor junction recovery characteristics. This metric is typically expressed as the standard deviation of fall-time measurements over hundreds of burst acquisitions.

The statistical spread in fall time originates from several interacting physical mechanisms within the transmitter hardware:

• Power supply decoupling network: Variations in the equivalent series resistance (ESR) of bypass capacitors cause inconsistent discharge rates as the power amplifier (PA) bias is removed.
• Charge trapping in semiconductors: Random de-trapping of charge carriers in the PA transistor's gate or drain regions introduces stochastic delays in the amplitude collapse.
• Thermal noise in control loops: The bias control circuitry exhibits Johnson-Nyquist noise that randomly modulates the precise moment the PA enters cutoff.
• Clock jitter in digital logic: If the turn-off is digitally controlled, timing uncertainty in the baseband processor's clock edges contributes directly to fall-time jitter.

While both metrics capture temporal instability in burst edges, fall-time variance is governed by fundamentally different physics than rise-time variance. Rise-time variance is dominated by the charging characteristics of the PA bias network and the phase-locked loop (PLL) acquisition dynamics. Fall-time variance, conversely, is dominated by discharge path impedances and the reverse recovery behavior of semiconductor junctions. The asymmetry between these two variances is itself a highly discriminative feature. A device with tightly controlled rise times may exhibit significantly larger fall-time variance due to poorly damped power supply ringing during the discharge phase, creating a unique rise-fall variance ratio.

Accurate fall-time variance measurement requires precise envelope extraction. The standard method uses the Hilbert transform to compute the analytic signal, from which the instantaneous magnitude is derived. The envelope is then processed to:

• Detect the burst offset using a threshold crossing algorithm on the envelope's trailing edge.
• Interpolate the 90% and 10% crossing points with sub-sample precision to avoid quantization errors.
• Compute the fall time for each burst and aggregate measurements into a statistical distribution. This approach is robust against carrier phase variations and provides the high temporal resolution necessary to resolve nanosecond-scale variance.

Fall-time variance is sensitive to environmental factors that must be characterized for robust fingerprinting:

• Temperature: Elevated junction temperatures accelerate discharge rates, potentially compressing the variance. Thermal compensation models are required for field deployment.
• Supply voltage: Battery sag in portable devices alters the initial conditions of the discharge, shifting the mean fall time and potentially the variance.
• Aging effects: Electrolytic capacitor degradation over years of operation increases ESR, systematically broadening the fall-time distribution. Channel-robust feature learning techniques, including domain adaptation, are applied to ensure the variance metric remains stable across these operational conditions.

Fall-time variance presents a challenging target for spoofing attacks. An adversary attempting to mimic a legitimate device's fall-time variance must precisely replicate:

• The statistical distribution, not just the mean fall time.
• The discharge path impedance of the target's specific power distribution network.
• The stochastic charge trapping behavior of the target's semiconductor components. These physical parameters are determined by manufacturing variances at the nanometer scale and are effectively unclonable. However, replay attacks using high-fidelity arbitrary waveform generators remain a threat vector that must be mitigated through liveness detection techniques, such as challenge-response protocols that alter the turn-off sequence.