Stay Connected, Leave no Trace: Enhancing Security and Privacy in WiFi via Obfuscating Radiometric Fingerprints

Luis F. Abanto-Leon
Both authors contributed equally to this research.

TU Darmstadt, Secure Mobile Networking Lab (SEEMOO)

Andreas Bäuml
[1]

TU Darmstadt, Secure Mobile Networking Lab (SEEMOO)

Gek Hong (Allyson) Sim

TU Darmstadt, Secure Mobile Networking Lab (SEEMOO)

Matthias Hollick

TU Darmstadt, Secure Mobile Networking Lab (SEEMOO)

Arash Asadi

TU Darmstadt, Wireless Communication and Sensing Lab (WiSe) & SEEMOO

The intrinsic hardware imperfection of WiFi chipsets manifests itself in the transmitted signal, leading to a unique radiometric fingerprint. This fingerprint can be used as an additional means of authentication to enhance security. In fact, recent works propose practical fingerprinting solutions that can be readily implemented in commercial-off-the-shelf devices. In this paper, we prove analytically and experimentally that these solutions are highly vulnerable to impersonation attacks. We also demonstrate that such a unique device-based signature can be abused to violate privacy by tracking the user device, and, as of today, users do not have any means to prevent such privacy attacks other than turning off the device.

We propose ,  a radiometric fingerprinting solution that not only is robust against impersonation attacks but also protects user privacy by obfuscating the radiometric fingerprint of the transmitter for non-legitimate receivers. Specifically, we introduce a randomized pattern of phase errors to the transmitted signal such that only the intended receiver can extract the original fingerprint of the transmitter. In a series of experiments and analyses, we expose the vulnerability of adopting naive randomization to statistical attacks and introduce countermeasures. Finally, we show the efficacy of  experimentally in protecting user privacy and enhancing security. More importantly, our proposed solution allows communicating with other devices, which do not employ .

§ INTRODUCTION

The omnipresence of WiFi devices in our daily lives demands strong and quantifiable security and privacy mechanisms to protect us from attackers. WiFi security mechanisms traditionally reside above the physical layer. This can be augmented by using physical layer characteristics (e.g., channel fading, interference, hardware impairments), which further enhance the security of WiFi. In fact, physical layer security gained momentum after a chain of acute vulnerabilities rendered these high-layer security mechanisms unsecure. This includes the disastrous RC4 vulnerability in WEP <cit.> as well as the more recent attacks on WPA2 (e.g., KRACK <cit.> and Kr00k <cit.>). We have also witnessed a variety of masquerading attacks in which the adversary mounts a machine-in-the-middle (MitM) attack by creating a rogue access point (AP), mimicking the identity (i.e., SSID) of a legitimate AP. It has been shown that physical layer security, in particular, radiometric (radio frequency) fingerprinting can thwart such attacks <cit.>.

1c    1c    cPredicted

1c 	   1c

1c 	    1c

Phone 1	    0.985 	    0.0 	    0.0 	    0.0     0.0

Phone 2  	    0.0     0.985     0.085     0.0     0.0

Phone 3  	    0.0     0.115     0.965     0.0     0.0

Phone 4  	    0.0     0.0     0.025     1.0     0.0

Phone 5  	    0.010     0.0     0.0     0.0     0.995

WiFi radiometric fingerprints of 5 identical phone (Samsung Galaxy S6). fig_differentPhones shows that the  fingerprints differ from one another even though the chipsets belong to the same series and manufacturer, thus allowing to distinguish among multifarious devices. fig_differentPhones_table shows that the devices can be distinguished with $ 96.5\% $ accuracy using a simple mean absolute error (MAE)-based classifier (MAE threshold $= 4.5^{\circ} $).

Radiometric fingerprinting techniques rely on measuring and extracting device-specific imperfections of the transmitter RF circuitry embedded in the emitted signal, which manifest in form of negligible but distinguishable errors, e.g., in phase (e.g., <cit.>) or frequency (e.g., <cit.>). These imperfections are so individualized that even chipsets from the same manufacturer have different fingerprints <cit.>.
In fig_differentPhones, we demonstrate that the radiometric fingerprint[These fingerprints are extracted from non-linear phase errors derived from device-specific hardware imperfections <cit.>] of five identical phones with the same WiFi chipset are visually distinguishable. Thus, it is not surprising that these devices can be easily differentiated from one another with high success ratio (i.e., $ 96.5 \% $).

Such degree of accuracy, on the one hand, reveals the potential of radiometric fingerprinting for achieving accurate authentication, thus enhancing security. On the other hand, it raises major privacy concerns since adversaries can locate/track devices using these unique fingerprints. Our work is motivated by the potential of radiometric fingerprinting in coping with security and privacy challenges.

Challenge I: Privacy.
Any unique identifier which can be easily measured/accessed by an adversary poses a significant privacy threat. Indeed, this is the motivation behind MAC address randomization in WiFi or temporary identifiers in cellular networks to prevent potential adversaries from tracking users. Radiometric fingerprints expose users to the same privacy vulnerability, and as of today, users do not have any means to prevent such privacy attacks other than turning off the device. While randomizing the physical layer characteristics of the signal is a plausible solution to enhance privacy, such procedure may degrade the communication link and disrupt or prevent legitimate radiometric fingerprinting, which brings us to the next challenges.

Challenge II: Security.
Radiometric fingerprints are typically considered a secure anchor for device authentication. Still, they are collectible by anyone in the vicinity of the transmitter who is capable of "overhearing" the packets, e.g., 50-100 meters for WiFi. This exposes the fingerprinting methods to impersonation attacks. Initial proposals argued that the cost of mimicking the fingerprints is too high <cit.>. To date, a wide range of software-defined radios (SDRs) costing from a few hundred (up to a few thousand) euros can collect and forge the fingerprints of other devices, e.g., through modifying the phases of emitted signals, as shown in Section <ref>. This issue is further exacerbated by the emergence of WiFi firmware patching tools <cit.>, which enables commercial WiFi chipsets to shape their signals and impersonate other devices.

Challenge III: Allowing for legitimate radiometric fingerprinting.
There are several solutions to hide ones' fingerprint: (i) Jamming, which defeats the primary purpose of WiFi, i.e., communication; (ii)  Constructive interference. The seminal work of Oh et al. on location privacy <cit.> and recent literature on privacy against WiFi sensing <cit.> use coordinated transmissions or a secondary signal repeater to obfuscate the physical layer information, which are not scalable and can be costly due to reliance on secondary devices; (iii) Fingerprint randomization at the transmitter has the advantage of scalability, but it can disrupt the communication link by distorting the channel estimation at the receiver. In <cit.>, the authors randomize the transmitted signal to obfuscate device-free localization but their approach introduces marginal impact on the quality of the communication. Furthermore, we must ensure that the randomization is reversible to allow legitimate fingerprinting.

§.§ Our approach

In this paper, we propose , a scalable approach that enhances the user privacy by obfuscating the radiometric fingerprints of the device from adversaries while allowing the use of CSI-based fingerprinting at legitimate receivers to strengthen the security of the network.

In essence,  adds a crafted randomized phase noise to the signal at the transmitter such that the radiometric fingerprints are obfuscated, but the quality of communication remains intact. Furthermore, we facilitate fingerprint extraction through a low-overhead synchronized random noise generation process between legitimate transmitters and receivers.
The properties of  are:

The latest radiometric fingerprinting solutions extract device-specific phase errors from the CSI <cit.>.
introduces deliberate phase noise to the subcarriers in the OFDM symbols on a per-frame basis such that the adversary can no longer estimate the actual radiometric fingerprint by analyzing the CSI, thus preventing the device identification/tracking via radiometric fingerprint.

Secure against impersonation.
We strive to maintain the possibility of legitimate fingerprinting without exposing the user to impersonation attacks. To this aim, we first devise a technique (synchronized phase noise generation), which enables only the legitimate receivers to denoise the transmitted signals and extract the original fingerprint. Secondly, we apply the obfuscation on a per-frame basis to eliminate the possibility of impersonation or reply attack via over-the-air packet sniffing. The effectiveness of this method is proven both theoretically and experimentally, even in presence of sophisticated adversaries with the capability of realizing statistical attacks.

Dual mode.
is designed to allow the legitimate use of wireless fingerprinting techniques (e.g., for authentication as in <cit.>) in presence of our obfuscation method.
Furthermore, a reduced form of  can be used to obfuscate the fingerprint of the device in order to only protect the device's privacy when fingerprinting is not used as an additional security feature, i.e., reversing the phase noise is not required.  We refer to this second operational mode as . In this mode, we can hide the fingerprint of the transmitter by executing the obfuscation blocks without any handshake or coordination with other receivers. As a result, we can ensure privacy protection in a much broader scenario, e.g., communicating with non--enabled devices, in absence of any active connections, or in connection establishment phase.

Low-overhead and scalable.
has low overhead from both computational and signaling/control message perspective.
Our simple yet effective obfuscation technique enabled extraction of CSI-based radiometric fingerprints at the legitimate receiver without any additional complex signal processing. Furthermore,  is highly scalable since it is implemented directly at the transmitter and does not rely on any secondary device <cit.>. Therefore, any WiFi device can obfuscate its fingerprint easily and independently.

§.§ Our contributions

To the best of our knowledge, this is the first work exposing privacy and security vulnerabilities of radiometric fingerprints as well as devising practical methods to resolve them. Note that prior works such as <cit.> propose techniques for preventing the exposure of unencrypted fields (e.g., headers and payload information) to counter, for instance, reactive jamming attacks that can adapt to the rate of transmission. While the approach prevents data analysis and acquisition of transmission cues, it does not protect the radiometric fingerprint of the device. The following summarizes our main contributions:

(i) Showing vulnerabilities of recent CSI-based radiometric fingerprinting solutions <cit.> to impersonation attacks (s_adversary_model);
(ii) Proposing a method for injecting artificial noise to the fingerprint without impacting communication quality (s4).
(iii) Designing , a benchmarking tool to assess the effectiveness of radiometric fingerprint obfuscation against statistical attacks (Vulnerability_analysis). Specifically,  is a maximum-likelihood-based estimator of the CSI, which we prove to be near-optimal through derivation of Cramer-Rao bounds (Appendix <ref>);
(iv)  Devising , a fingerprint obfuscation framework that circumvents the privacy issues without impacting the communication quality (s_algorithm).
(v) We prove the efficacy of our proposals, both analytically and experimentally.

§ FINGERPRINTING PRIMER

Radio signal analysis to identify devices and distinguish between friends and foes dates back to the time of the Vietnam war. In the same line, radiometric fingerprinting has gained momentum in recent years with the surge of attacks that leverage hardware impairments to breach privacy and security in wireless networks. Recently, CSI-based radiometric fingerprinting gained popularity due to the availability of CSI extraction tools <cit.>. These tools allow  per-frame CSI collection from commercial WiFi chipsets (e.g., Intel, Qualcomm, Broadcom), making CSI-based fingerprinting practical and feasible for all devices. In the following, a short overview of CSI estimation and CSI-based fingerprinting is provided.

§.§ Channel estimation in WiFi

As a prelude to CSI-based fingerprinting, we describe channel estimation in WiFi throughout this section. fig_phy-frame shows the IEEE 802.11ac PHY frame structure, wherein we recognize four distinct fields: STF, LTF, SIG, and DATA (cf. 17.3 in <cit.>). The receiver uses the STF field for signal detection, automatic gain control, time synchronization, and coarse CFO. The LTF field is employed for fine CFO estimation and channel estimation. Channel estimation is performed by sending BPSK pilots over the LTF subcarriers of two consecutive OFDM symbols. The SIG and DATA fields convey the MCS level and the payload, respectively. The OFDM symbols in the SIG and DATA fields are equalized using the channel estimated by the preceding LTF field. The prefix "L-" denotes the legacy fields, which are included for compatibility with IEEE 802.11a.

IEEE 802.11ac PHY frame format.

Let $ K $ denote the number of subcarriers and $ \mathbf{s} = \left[ s_1, \cdots, s_K \right]^T \in \mathbb{C}^{K \times 1} $ the BPSK pilot symbols (defined in Equation 19-23 of <cit.>). Also, let $ \mathbf{F} \in \mathbb{C}^{K \times K} $ and $ \mathbf{F}^H \in \mathbb{C}^{K \times K} $ denote the discrete Fourier transform (DFT) matrix and the inverse DFT (IDFT) matrix, respectively. Moreover, $ \mathbf{F} \mathbf{F}^H = \mathbf{I} $, with $ \left( \cdot \right)^H $ representing the Hermitian transpose. The discrete-time OFDM symbol is given by $ \mathbf{x} = \mathbf{F}^H \mathbf{s} $ <cit.>. In order to improve the signal robustness against multi-path interference, the periodic OFDM symbol $ \tilde{\mathbf{x}} $ is produced by appending the cyclic prefix (CP) to $ \mathbf{x} $. The CP consists of the last $ L $ samples of $ \mathbf{x} $, thus $ \tilde{\mathbf{x}} = \left[ \mathbf{x}^T_{\left[ K-L+1:K \right]},  \mathbf{x}^T  \right]^T \in \mathbb{C}^{(K+L) \times 1} $. Appending the CP to $ \mathbf{x} $ transforms the linear convolution between $ \tilde{\mathbf{x}} $ and the channel $ \mathbf{c} = \left[ c_1, \cdots, c_J \right]^T \in \mathbb{C}^{J \times 1} $  (with $ J < L $ paths) into a circular convolution. This has the advantage of simplifying OFDM demodulation and equalization at the receiver. Upon transmitting $ \tilde{\mathbf{x}} $ over the channel $ \mathbf{c} $, the receiver obtains $ \tilde{\mathbf{r}} = \tilde{\mathbf{x}} \ast \mathbf{c} $, where $ \ast $ denotes the convolution operator. To remove the impact of inter-block interference between adjacent LTF frames (caused by multi-path propagation), we discard the first $ L $ elements of $ \tilde{\mathbf{r}} $, thus yielding $ \mathbf{r} = \tilde{\mathbf{r}}_{\left[ L+1:L+K \right] } \in \mathbb{C}^{K \times 1} $. The received signal $\mathbf{r} $ can be expressed as:

\begin{equation} \label{e3-1}
%{ $
\underbrace{\begin{pmatrix}
r_1 \\
%		r_2 \\
\vdots \\
\end{pmatrix}}_{\mathbf{r}}
\underbrace{\begin{pmatrix}\vspace{-2.5mm}
c_1      & 0       & \cdots & 0       & c_J      & \cdots & c_2 \\ \vspace{-1mm}
%			c_2      & c_1     &        & 0       & 0        &        & c_3 \\
\vdots   & \vdots  &        & \vdots  & \vdots   &        & \vdots \\ \vspace{-1mm}
c_J      & c_{J-1} &        & 0       & 0        &        & 0 \\ \vspace{-2mm}
0        & c_J     &        & 0       & 0        &        & 0 \\\vspace{-2mm}
\vdots   & \vdots  &        & \vdots  & \vdots   &        & \vdots \\ \vspace{-2mm}
0        & 0       & \cdots & c_J     & c_{J-1}  & \cdots & c_1 \\\vspace{-4mm}
\end{pmatrix}}_{\mathbf{C}}
\underbrace{\begin{pmatrix}
x_1 \\
%			x_2 \\
\vdots \\
\end{pmatrix}}_{\mathbf{x}}
\underbrace{\begin{pmatrix}
w_1 \\
%			w_2 \\
\vdots \\
\end{pmatrix},}_{\mathbf{w}}
%	$ }
\end{equation}

where $ \mathbf{w} \sim \mathcal{CN} \left( 0, \sigma^2 \mathbf{I} \right) $ denotes circularly-symmetric complex Gaussian noise. The receiver demodulates the received signal $ \mathbf{r} $ by multiplying it with $ \mathbf{F} $ to obtain $ \mathbf{y} = \mathbf{F} \mathbf{r} = \mathbf{F} \mathbf{C} \mathbf{x} + \mathbf{F} \mathbf{w} $. The convolution matrix $ \mathbf{C} \in \mathbb{C}^{K \times K} $ is circulant, which is a consequence of adding the CP to the transmitted signal. Circulant matrices can be expressed via eigen-decomposition as $ \mathbf{C} = \mathbf{F}^H \mathbf{H} \mathbf{F} $, where $ \mathbf{H} = \mathrm{diag} \left( \left[ h_1, \cdots, h_K \right] \right) $ represents a diagonal matrix containing the eigenvalues of $ \mathbf{C} $ <cit.>. As a result, the demodulated signal $ \mathbf{y} $ collapses to $ \mathbf{y} = \mathbf{F} \big( \mathbf{F}^H \mathbf{H} \mathbf{F} \big) \big( \mathbf{F}^H \mathbf{s} \big) + \mathbf{F}^H \mathbf{w} = \mathbf{H} \mathbf{s} + \mathbf{w} $. More specifically,

\begin{equation} \nonumber
%{ $
\underbrace{\begin{pmatrix}
y_1 \\
\vdots \\
\end{pmatrix}}_{\mathbf{y}}
\underbrace{\begin{pmatrix}
h_1      & \cdots 	& 0       \\
\vdots   & \ddots     & \vdots  \\
0        & \cdots       	& h_K
\end{pmatrix}}_{\mathbf{H}}
\underbrace{\begin{pmatrix}
s_1 \\
\vdots \\
\end{pmatrix}}_{\mathbf{s}}
\underbrace{\begin{pmatrix}
w_1 \\
\vdots \\
\end{pmatrix}.}_{\mathbf{w}}
\end{equation}

Thus, for any subcarrier $ k \in \mathcal{K} = \left\lbrace 1, \cdots, K \right\rbrace $, the received symbol is expressed as

\begin{equation} \label{e3-2}
y_k = h_k s_k + w_k = \left| h_k \right| e^{j \phi_k} s_k + w_k,
\end{equation}

which shows that the channel affects each pilot symbol $ s_k $ by a complex-valued factor $ h_k = \left| h_k \right| e^{j \phi_k} $ and additive noise $ w_k $. Since the pilot symbols $ \mathbf{s} $ are known by the receiver, the CSI vector $ \mathbf{h} = \left[ h_1, \cdots, h_K \right]^T $ can be obtained upon equalizing each received symbol $ y_k $ with the compensation factor $ \frac{s^*_k}{\left| s_k \right|^2 } $. Thus, the estimated channel in subcarrier $ k $ is given by:

\begin{equation} \label{e3-3}
\tilde{h}_k = h_k s_k \frac{s^*_k}{\left| s_k \right|^2} + w_k \frac{s^*_k}{\left| s_k \right|^2} = \left| h_k \right| e^{j \phi_k} + w_k.
\end{equation}

§.§ CSI-based fingerprinting

CSI-based radiometric fingerprinting techniques consist of analyzing the CSI to extract features that are unique to the transmitting device.
Specifically, Zhuo et al. <cit.> found that WiFi chipsets exhibit non-linear phase errors that change across subcarriers and are analogous to a sinusoidal function, as shown in fig_differentPhones. These phase errors are caused by I/Q imbalance as a result of hardware imperfections. It was shown in <cit.> that these errors are latent signatures that can be extracted upon removing the linear phase errors from the CSI. Building on this finding, Liu et al. <cit.> harness these non-linear errors as CSI-based radiometric fingerprints for identification, thus preventing impersonation by unauthorized WiFi devices. Following the same notation in (<ref>) and (<ref>), we denote the CSI phases by $ \boldsymbol{\Phi} = \left[ \phi_1, \cdots, \phi_K \right]^T $, which can be further decomposed into

\begin{equation} \label{e3-4}
\boldsymbol{\Phi} ~ = ~ \underbrace{\boldsymbol{\varphi} ~ + ~ \boldsymbol{\omega} ~ + ~ \boldsymbol{\theta} ~ + ~ \boldsymbol{\psi}}_\text{linear errors} ~~~ + \underbrace{\boldsymbol{\epsilon}}_{\substack{\text{non-linear error (fingerprint)}}},
\end{equation}

where $\boldsymbol{\varphi} \in \mathbb{R}^{K \times 1} $ represents the phase of the signal at the transmitter while $ \boldsymbol{\omega} \in \mathbb{R}^{K \times 1} $, $ \boldsymbol{\theta} \in \mathbb{R}^{K \times 1}$ and $\boldsymbol{\psi} \in \mathbb{R}^{K \times 1} $ denote the phase errors due to sampling frequency offset, frame detection delay and time of flight, respectively. By using the mirror subcarriers, the linear part of the phase errors can be canceled <cit.>. Hence, the non-linear phase errors $ \boldsymbol{\epsilon} \in \mathbb{R}^{K \times 1} $ are obtained by the following equation

\begin{equation} \label{e3-5}
\boldsymbol{\epsilon} =  \boldsymbol{\Phi} - \left( 2 \pi \lambda \cdot \mathbf{v} + \mathbf{1} Q^\star \right),
\end{equation}

where $ \mathbf{v} = \big[ -K/2, \cdots, -1, 1, \cdots, K/2 \big]^T $
and $ \lambda $ is a constant used for nullifying the linear phase rotation in a specific frame whereas $ Q^\star $ is used for phase error normalization <cit.>.

The authors show that the non-linear phase errors exhibit both time and location invariance and change significantly even across devices of the same manufacturer. As a result, these non-linear phase errors can be used as highly distinctive radiometric fingerprints for device identification by leveraging the above described approach in <cit.>. Even though the difference is very small, the phones are distinguishable from one another, as illustrated in fig_differentPhones_table. As a result, the authors conclude that these fingerprints can be used as countermeasures against impersonation attacks. However, we show in the next section that impersonation is indeed possible.

§ ADVERSARY MODEL AND ATTACK SCENARIO

In this section, we introduce the adversary model and devise two attack scenarios, which aim at breaching privacy and security.

§.§ Adversary model

Adversary model. We consider an impersonation scenario, where the adversary has captured the fingerprint of the victim (legitimate user). The adversary forges the fingerprint of the victim by introducing additional phase rotations to its own fingerprint.

Adversary prediction on the presence time of $5$ different phones turned on and off at different time intervals. An adversary can accurately determine the presence of a specific user in a network by tracking the radiometric fingerprints.

We consider a scenario where the legitimate device (i.e., client) communicates with an AP and vice versa, see fig_adversaryModel.

We further consider an adversary in transmission range of the legitimate communication with the following capabilities:
(i) sniffing packets sent by the legitimate device; (ii) extracting the fingerprint of the legitimate device from the CSI;
(iii) knowing its own fingerprint and the ability to change it arbitrarily.
Hence, the adversary can breach the user privacy upon extracting the fingerprint from the sniffed packets.
Even if the client employs MAC address randomization to remain anonymous, the adversary can identify and track the client via the radiometric fingerprint (Attack scenario I).
Further, having the ability to change its fingerprint arbitrarily, the adversary can subsequently modify its own fingerprint to impersonate the client, thus compromising the security of the system (Attack scenario II).
Note that we do not consider an adversary launching a denial-of-service attack by jamming the WiFi signals as this will disrupt the communication in WiFi channels as a whole.

§.§ Attack scenario I: Violating user privacy by tracking the radiometric fingerprints

This attack focuses on tracking the presence of specific devices in the network using their radiometric fingerprints. In this scenario, the privacy-invading adversary silently sniffs the encrypted traffic over a WiFi network, extracts the fingerprints from the CSI, and creates a database recording time and duration in which a device was present in the vicinity. In order to show the efficacy of this attack experimentally, we setup an adversary and $5$ phones that are entering and leaving the network at different times over the course of 10 minutes. We depict the results of this experiment in fig_privacy_attack, in which the ground truth is presented in solid bars, whereas the hatched bars indicate the adversary's prediction. We observe that the adversary is able to determine the presence time of the different phones with fairly high accuracy. Note that MAC layer anonymization techniques cannot stop our adversary from tracking the presence of users across networks since such techniques do not conceal the inherent physical cues of the device, i.e., radiometric fingerprint. In an era where smartphones, smartwatches, and other WiFi-enabled wearables are omnipresent, these simple attacks expose us to significant privacy risks at workplace and at home.

§.§ Attack scenario II: Compromising security via impersonation attacks

L1    L2    L3    L4    L5    L6    L7    L8    L9    L10    L11
2.4 GHz	   $99.8\%$    $99.6\%$    $98.3\%$    $88.7\%$    $98.3\%$    $99.4\%$    $63.9\%$    $76.5\%$    $31.9\%$    $78.3\%$    $34.9\%$
5 GHz	   $95.8\%$    $99.7\%$    $99.5\%$    $97.6\%$    $99.6\%$    $72.1\%$    $74.9\%$    $79.4\%$    $0\%$    $0\%$    $0\%$

The success rate of impersonation attacks is shown as a heatmap throughout the experimental site when using $2.4$ GHz. Impersonation is possible even in challenging scenarios, i.e., through a 30-centimeter thick ferro-concrete wall. The table shows the success rate at $2.4$ and $5$ GHz bands. The success rate at $5$ GHz is lower due to higher propagation and penetration loss compared to $2.4$ GHz.

Impersonation attack on CSI-based radiometric fingerprinting.
Impersonation is feasible when the adversary is capable of introducing additional crafted phase rotations per subcarrier to match the fingerprint of the victim.

Radiometric fingerprinting can enhance the security of networks by enabling means of additional authentication based on physical layer properties of devices <cit.>.
However, we found that an adversary can easily impersonate other devices exploiting the fingerprinting scheme proposed by Liu et al. <cit.>.
We mount such an impersonation attack using an SDR as follows: we first compute the fingerprint of the SDR by connecting it to another receiver (e.g., another SDR, signal analyzer).
This needs to be done only once.
Next, we measure the fingerprint of the target device, which only requires the adversary to sniff one (encrypted or unencrypted) packet sent by the target device.
Knowing the proprietary fingerprint and that of a target, we can compute the phase offset on each subcarrier.
These phase offsets are added to the LTF subcarriers and all subcarriers in the succeeding OFDM symbols (cf. fig_phy-frame) at the SDR.
Consequently, the fingerprint extracted by the receiver matches that of the target device.
The SDR provides flexible processing capabilities that allow us to introduce phase rotations to the transmission chain easily.
In fig_fakeFingerprint, we demonstrate how accurately the SDR (i.e., adversary) can replicate the fingerprint of another device (i.e., victim).

We now analyze the efficacy of the impersonation attack in a real-world scenario (i.e., an office building).
We set up an AP which employs the CSI-based fingerprinting mechanism in <cit.> for authentication.
To show the severity of the attack, we mount the attack in different locations in the vicinity of the victims, as depicted in  fig_impersonation_attack.
The adversary is transmitting 1000 packets in each location from which the access point calculates the fingerprints and compares them against a reference fingerprint of the legitimate user.
We conduct this experiment for each of the WiFi bands (i.e., $2.4$ and $5$ GHz) and show the results in the table in fig_impersonation_attack.
In the $2.4$ GHz band, we observe that the adversary can successfully impersonate the victim in all locations.
While the attack is very successful in line-of-sight scenarios (i.e., inside the lab), we observe that it still yields very high success rates in nlos scenarios, e.g., the hallway or even in the office across the hallway.
We kept all doors closed throughout the experiments.
We also observe that the impersonation attack is possible even in highly challenging scenarios, i.e., behind a 30-centimeter thick ferro-concrete wall. However, the success rate is lower due to high signal attenuation.

Due to higher propagation and penetration loss at $5$ GHz band, the success rate in the nlos locations (i.e., L5 to L11) is lower. In particular, in locations L9 to L11, no signal was received by the AP.
However, locations L5 to L8 yield similar results in $5$ GHz and $2.4$ GHz bands.
We conclude that, as long as the adversary is in range of the access point, they can successfully effectuate an impersonation attack regardless of the frequency band used by the access point.

§.§ Takeaway

In this section, we emphasize the need for a secure and privacy-preserving fingerprinting solution.
Existing fingerprinting solutions based on CSI are capable of distinguishing between different devices, even of the same model, allowing adversaries to track the presence of users in a network.
Further, we show that an adversary can successfully impersonate the victim's device even through thick composite steel–concrete walls, which are among the most disruptive construction materials for wireless signals.
Hence, there are two main takeaway messages from this section: $(i)$ device fingerprints can be used to invade privacy of users and, as of the writing of this paper, there is no protection for users; and $(ii)$ active deployments of CSI-based fingerprinting schemes can be attacked.

§ HOW TO INJECT ARTIFICIAL NOISE TO FINGERPRINTS WITHOUT IMPACTING COMMUNICATION

Here we discuss our method for injecting artificial noise (i.e., randomized phase rotation) to the radiometric fingerprints.

We further prove why it does not impact the quality of communication.

Diagram illustrating the phase randomization method at the transmitter. Additional random phase rotation at every subcarrier protects the fingerprint of the transmitter and therefore prevents impersonation.

Fingerprints before and after obfuscation. Upon including random phase rotations in the subcarriers, the recovered fingerprint differs from the original.

Throughput before and after obfuscation. The throughput is not affected by the phase rotations, as these can be reverted at the receiver.

Randomizing the radiometric fingerprints is the first logical step towards maintaining user privacy. However, if not carefully designed, the randomization can potentially break/degrade the communication link. As described in Section <ref>, the WiFi receiver relies on the LTF field for channel estimation. To ensure that obfuscation via randomization does not disrupt communication, we maintain the introduced phase rotations on each subcarrier constant for the duration of the whole frame. As a result, the estimated CSI from the preambles remains valid for the succeeding VHT-DATA frame, as shown in fig_phy-frame, thus allowing successful decoding of information. In the following, we describe the process. fig_rand_overview shows the transmitter chain of our proposed fingerprint obfuscation method, in which we include deliberate phase randomization across all OFDM subcarriers. Having the pre-shared key and randomization index, the receiver can decode the message and extract the fingerprint without impacting the communication.

Let $ z_k $ denote the phase rotation in subcarrier $ k $ intentionally included by the transmitter. From (<ref>), the signal received in the $ k $-th subcarrier is given by $ y_k = h_k s_k e^{j z_k} + w_k $. Using (<ref>), the CSI at the receiver is expressed as

\begin{equation} \label{e4-3}
\tilde{h}_k = h_k e^{j z_k} + w_k = \left| h_k \right| e^{j (\phi_k + z_k)} + w_k.
\end{equation}

Compared to (<ref>), the factor $ e^{j z_k} $ in (<ref>) obfuscates the legitimate CSI by shifting its phase information. As a result, the phase $ z_k $ will appear in the radiometric fingerprint extracted by an adversary, thus safeguarding the device original fingerprint. The effects of this phase randomization mechanism can only be reverted by a trusted receiver that is aware of $ z_k $.

In particular, we assume that the phase $ z_k $ is a realization of a random variable $ Z_k $, that can be generated locally at the receiver since the pre-shared key to the random generator is known.
As a result, the receiver generates $ z_k $ and multiplies the perturbed $ \tilde{h}_k $ in (<ref>) by $ e^{-j z_k} $ yielding $ e^{-j z_k} \left( \left| h_k \right| e^{j (\phi_k + z_k)} + w_k \right) = \left| h_k \right| e^{j \phi_k} + w_k $, which is equivalent to (<ref>), and therefore showing that the CSI remains unaffected as the phase randomization can be removed. In addition, we denote the capacity of the channel in (<ref>) by $ C' = \log_2 \left( 1 +  \left| \left| h_k \right| e^{j \phi_k} \right|^2 / \sigma^2 \right) = \log_2 \left( 1 + \left| h_k \right|^2 / \sigma^2 \right) $. Similarly, the channel capacity of (<ref>) is denoted by $ C'' = \log_2 \left( 1 + \left| \left| h_k \right| e^{j (\phi_k + z_k)} \right|^2 / \sigma^2 \right) = \log_2 \left( 1 + \left| h_k \right|^2 / \sigma^2 \right) $, thus revealing the equivalence $ C' \equiv C'' $. This shows that the channel capacity before and after randomization does not change. Therefore, for a given MCS level, the throughput is not altered by phase randomization as long as the phase $ z_k $ is generated correctly at each receiver. We generalize this idea for every subcarrier $ k \in \mathcal{K} $.
In fig_Rand_fingerprint, we illustrate the original fingerprint of a device as well as the obfuscated versions, in which the random phase rotations are obtained from uniform and Gaussian distributions, i.e., $ Z_k \sim \mathcal{U} \big( \mu_k, \xi^2_k \big) $ and $ Z_k \sim \mathcal{N} \big( \mu_k, \xi^2_k \big) $ with $ \mu_k = 0 $ deg and $ \xi^2_k = 60 $ deg2 (deg $ \equiv ~ ^\circ $). Since the additional randomized phase $ z_k $ differs for each subcarrier, the adversary cannot leverage the linear phase error difference among subcarriers to identify the users.
In particular, if the same phase rotation $ z_k $ is used for all $ K $ subcarriers, the original fingerprint can be easily extracted via the method proposed in <cit.> as such method exploits the phase difference among adjacent subcarriers, which in this case would be constant and easy to remove. Moreover, we corroborate experimentally that the throughput is not affected by our proposed obfuscation method. In particular, for the obfuscated signals depicted in fig_Rand_fingerprint, we show the throughput in fig_Rand_fingerprint_throughput.

In the next section, we discuss the robustness of this approach against statistical attacks.

§ : A BENCHMARKING TOOL FOR ASSESSING VULNERABILITY TO STATISTICAL ATTACKS

Statistical attacks are common in cryptography where the adversary exploits statistical weaknesses of the underlying random number generators or hashing algorithms to discover the  secrets, e.g., birthday attacks <cit.>. In the course of our experiments, we discovered that an adversary can mount similar attacks on phase randomization to restore the original fingerprint. Viewing this as an estimation problem, we devise , which is a maximum likelihood-based approach design to restore the legitimate (unimpaired) CSI from a set of captured CSI measurements with obfuscated fingerprints. Thus, if the legitimate CSI is restored accurately, the radiometric fingerprint can be extracted by the method described in Section <ref> and used for malicious purposes. In essence, we designed  as a tool to evaluate the efficiency of RF-fingerprint obfuscation against statistical attacks. Specifically, we designed an experiment in which the adversary captures 10000 CSI samples (within $\sim$ 10 seconds) and uses  to estimate the legitimate CSI. This experiment showed that an adversary can denoise the fingerprint even without the knowledge of the probability density function used for phase randomization. We will elaborate on  and the experimental results in Section <ref>. We prove that this vulnerability stems from the zero-mean nature of the selected distributions, see Section <ref>.

fig_rand_phase_mag shows the magnitude and phases of CSI measurements. We assume that the channel impulse response is invariant for a short interval $ \tau $ compliant with the channel coherence time $ T_c $. Thus, small-scale oscillations in the CSI magnitude are attributed to noise. On the other hand, the CSI phase changes abruptly between contiguous measurements due to phase randomization.

Collected CSI measurements with additional synchronization phase rotations obtained from a zero-mean unit-variance Gaussian probability density function.

§.§ A maximum-likelihood-based estimator for evaluating statistical attacks

minimizes the overall approximation error between the unknown CSI and the collected measurements. The premise is that adversaries do not have information on the probability density function used for CSI phase randomization. Let $ \mathbf{M} = \left[ \mathbf{m}_1, \cdots, \mathbf{m}_N \right] \in \mathbb{C}^{K \times N}$ denote a matrix that collects $ N $ measurements in all $ K $ subcarriers, where vector $ \mathbf{m}_n \in \mathbb{C}^{K \times 1} $ represents the CSI (contaminated with phase randomization and noise) in the $ n $-th captured LTF frame. Also, let $ \mathbf{u} =  \left[ \left| h_1 \right| e^{j \phi_1}, \cdots, \left| h_K \right| e^{j \phi_K} \right]^T \in \mathbb{C}^{K \times 1} $ denote the unknown unrandomized CSI vector. Further, $ \boldsymbol{\Delta} = \left[ \mathbf{m}_1 - \mathbf{u}, \cdots, \mathbf{m}_N - \mathbf{u} \right] = \mathbf{M} - \left( \mathbf{1}^T \otimes \mathbf{u} \right) $ represents the error matrix between the unknown CSI $ \mathbf{u} $ and the measurements $ \mathbf{M} $, where $ \otimes $ is the Kronecker product. We define the following problem:

\begin{equation} \label{e4-4}
\setlength{\abovedisplayskip}{1.0pt}
\setlength{\belowdisplayskip}{1.0pt}
\mathcal{B}: \mathbf{u}^\star = \argmin_{ \mathbf{u} \in \mathbb{C}^{K \times 1} }
\underbrace{\left\| \mathbf{M} - \mathbf{1}^T \otimes \mathbf{u} \right\|^2_\mathrm{F},}_J
\end{equation}

where $ \left\| \cdot \right\|^2_\mathrm{F} $ denotes the Frobenius norm. To solve problem $ \mathcal{B} $, we have used several Kronecker product properties specified in Appendix A. Recalling that $ \left\| \boldsymbol{\Delta} \right\|^2_\mathrm{F} = \mathrm{Tr} \left( \boldsymbol{\Delta}^T \boldsymbol{\Delta} \right) $, the objective function can be recast as $ J = \mathrm{Tr} \Big( \big( \mathbf{M} - \mathbf{1}^T \otimes \mathbf{u} \big)^T \big( \mathbf{M} - \mathbf{1}^T \otimes \mathbf{u} \big) \Big) $. By employing Property 1 and Property 2, the objective collapses to $ J = \mathrm{Tr} \big( \mathbf{M}^T \mathbf{M} - \left( \mathbf{1} \otimes \mathbf{u}^T \right) \mathbf{M} - \mathbf{M}^T \left( \mathbf{1}^T \otimes \mathbf{u} \right) + \mathbf{L} \otimes \left( \mathbf{u}^T \mathbf{u} \right) \big) $, where $ \mathbf{L} = \mathbf{1} \mathbf{1}^T $. To find a critical point $ \mathbf{u}^\star $ that minimizes $ J $, we compute the gradient of $ J $ with respect to $ \mathbf{u} $ and equate it to zero, i.e., $ \nabla_\mathbf{u} J = 0 $. To this purpose, we resort to the use of differentials. Thus, $ d J = \mathrm{Tr} \Big( - \big( \mathbf{1} \otimes d \mathbf{u}^T \big) \mathbf{M} - \mathbf{M}^T \big( \mathbf{1}^T \otimes d \mathbf{u} \big) \nonumber + \mathbf{L} \otimes \big( d \mathbf{u}^T \mathbf{u} \big) + \mathbf{L} \otimes \big( \mathbf{u}^T d \mathbf{u} \big) \Big) $, where $ d $ denotes the differential operator and $ d \mathbf{M} = 0 $, $ d \mathbf{L} = 0 $. Using Property 2, Property 3 and Property 4, the differential of $ J $ is expressed as $ dJ = \mathrm{Tr} \Big( - \big( \mathbf{M} \mathbf{1} \big) \otimes d \mathbf{u}^T - \mathbf{1}^T \otimes \big( \mathbf{M}^T d \mathbf{u} \big) + \mathbf{L} \otimes \big( \big( d \mathbf{u}^T \big) \mathbf{u} \big) + \mathbf{L} \otimes \big( \mathbf{u}^T d \mathbf{u} \big) \Big) $. Now, by means of Property 4 and Property 5 we obtain  $ dJ = 2 \mathrm{Tr} \Big( \big(  - \big( \mathbf{M} \mathbf{1} \big)^T + N \mathbf{u}^T \big) d \mathbf{u} \Big) $. The Frobenius inner product of two matrices $ \mathbf{A} $ and $ \mathbf{B} $ is defined as $ \left\langle \mathbf{A}, \mathbf{B} \right\rangle_\mathrm{F} \equiv \mathrm{Tr} \big( \mathbf{A}^T \mathbf{B} \big) $. Therefore, $ dJ = 2 \left\langle - \mathbf{M} \mathbf{1} + N \mathbf{u}, d \mathbf{u} \right\rangle_\mathrm{F} $, from where we obtain $ \nabla_\mathbf{u} J = 2 \big( - \mathbf{M} \mathbf{1} + N \mathbf{u} \big) $. Upon equating $ \nabla_\mathbf{u} J $ to zero, we obtain $ \mathbf{u}^\star = \frac{1}{N} \mathbf{M} \mathbf{1} = \frac{1}{N} \sum^N_{n = 1} \mathbf{m}_n $. The denoised CSI phase $ \boldsymbol{\Phi} $ for all subcarriers is computed as

\begin{equation} \label{e4-5}
\boldsymbol{\Phi}^\star = \arctan \left( \mathfrak{Im} \left\{ \frac{1}{N} \sum^N_{n = 1} \mathbf{m}_n \right\} \oslash \mathfrak{Re} \left\{ \frac{1}{N} \sum^N_{n = 1} \mathbf{m}_n \right\} \right).
\end{equation}

Restored fingerprint upon CSI denoising. We observe that an adversary capable of mounting a statistical attack can obtain the original fingerprint even after randomization.

Since denoised CSI is available through (<ref>), the radiometric fingerprint $ \boldsymbol{\epsilon}^\star $ can be extracted using (<ref>). <cit.> fig_recovered_bison shows the restored fingerprints for uniform and Gaussian distributions with mean $ \mu_k = 0^{\circ} $ and variance $ \xi^2_k = 60 $ deg2, for all subcarriers $ k \in \mathcal{K} $. In both cases, we have collected $ N = 10000 $ measurements. We observe that the obtained fingerprints exhibit a small deviation with respect to the original one. When uniform distribution is used, the mean absolute error (MAE) is $ 0.7489^{\circ} $, whereas that of Gaussian distribution is $ 1.2252^{\circ}$. Although both distributions have a variance of $ \xi^2_k = 60 $ deg2, for the uniform case, this signifies that the range of phase rotations is bounded to $ \left[ -99.2^{\circ}; 99.2^{\circ} \right]  $. However, for the Gaussian case, the range of rotation phases spans $ \left[ -180^{\circ}; 180^{\circ} \right] $.

In Appendix B,  we analyze the  estimator under the Cramer-Rao bound (CRB) framework. We show that  attains near-optimality in estimating the CSI.

§.§ Statistical rationale for CSI denoising feasibility via

If an efficient estimator does not exist for an unknown variable, the maximum-likelihood estimation often yields an asymptotically efficient estimator for sufficiently large number of samples. Based on this premise, we expect the effect of randomization to be averaged out. Thus, motivated by the outcome of , we  justify why the effect of randomization, introduced in Section <ref>, can be removed. By assuming that an adversary is capable of collecting an infinite number of measurements, we  within the law of large numbers; which states that the average of outcomes obtained from a large number of experiments approximates the expected value.

Assumption: Let $ f_{Z_k} \big( z_k \big) $ be a symmetric zero-mean probability density function governing the random phase rotation $ Z_k $, spanning an interval with upper and lower bounds $ z^U_k = R_k $ and $ z^L_k = -R_k $, respectively.

Invoking the assumption above, the expected value of the corrupted CSI information in subcarrier $ k $ according to (<ref>) is defined as $ \mathbb{E} \left[ \tilde{h}_k \right] = \mathbb{E} \left[ h_k e^{j Z_k} \right]  + \mathbb{E} \left[ w_k \right] $, where $ \mathbb{E} \left[ h_k e^{j Z_k} \right] = h_k \mathbb{E} \left[ e^{j Z_k} \right] = h_k \int_{-R_k}^{R_k} e^{j z_k} f_{Z_k} \big( z_k \big) d z_k $.  Using integration by parts, $ \mathbb{E} \left[ e^{j Z_k} \right]  $ can be recast as,

\begin{equation} \label{e4-6}
\mathbb{E} \left[ e^{j Z_k} \right] =  2 \sin \big( R_k \big) f_{Z_k} \big( R_k \big) - \int_{-R_k}^{R_k} \sin \big( z_k \big) f'_{Z_k} \big( z_k \big) d z_k
+ j \int_{-R_k}^{R_k} \cos \big( z_k \big) f'_{Z_k} \big( z_k \big) d z_k = {\beta^{\mathrm{real}}_k} + j {\beta^{\mathrm{imag}}_k},
\end{equation}

where the equivalence $ \int u dv = uv -\int v du $ is used assuming that $ u = f_{Z_k} \big( z_k \big) $, $ dv = e^{j z_k} d z_k $ and $ f_{Z_k} \big( -R_k \big) = f_{Z_k} \big( R_k \big) $ due to symmetry. In the following, we instantiate three fundamental corollaries that allow us to gain insights on the characteristics of (<ref>).

Corollary 1: If $ g(x) $ is an even function, then its derivative $ g'(x) $ is an odd function.

Corollary 2: If $ g(x) $ is even and $ h(x) $ is odd, then $ q(x) = g(x) h(x) $ is odd.

Corollary 3: If $ g(x) $ is odd, then $ \int^a_{-a} g(x) dx = 0 $ for $ a > 0 $.

By means of Corollary 1, we assert that $ f'_{Z_k} \big( z_k \big) $ is an odd function. Also, via Corollary 2, the function $ \cos(z_k) f'_{Z_k} \big( z_k \big) $ is odd. Finally, by means of Corollary 3 the value of $ \beta^{\mathrm{imag}}_k = \int_{-R_k}^{R_k} \cos \big( z_k \big) f'_{Z_k} \big( z_k \big) = 0 $. As a result, $ \mathbb{E} \left[ h_k e^{j Z_k} \right] =  \beta^{\mathrm{real}}_k h_k $, which shows that (on average) the CSI in every subcarrier $ k $ is affected only by a real-value attenuation factor $ \beta^{\mathrm{real}}_k $ without altering the phase.

Claim: When we obfuscate the fingerprints through phase randomization using symmetric zero-mean distributions,  produces an unbiased estimator for the CSI phase.

Harnessing this outcome, we compute the expected value of the proposed  estimator, i.e., $ \mathbb{E} \left[ \mathbf{u}^\star \right]  = \frac{1}{N} \sum^N_{n = 1} \mathbb{E} \left[  \mathbf{m}_n \right]  = \frac{1}{N} \sum^N_{n = 1} \mathbb{E} \left[  \mathrm{diag} \left( e^{ j \mathbf{z}_n } \right) \mathbf{h} + \mathbf{w}_n \right] $, where $ \mathbf{z}_n = \left[ Z_{n,1}, \cdots, Z_{n,K} \right]^T $ and $ \mathbf{w}_n = \left[ w_{n,1}, \cdots, w_{n,K} \right]^T $. Thus, $ \mathbb{E} \left[  \mathbf{u}^\star \right] $ reduces to

\begin{align} \label{e4-9}
\mathbb{E} \left\lbrace \mathbf{u}^\star \right\rbrace
\begin{pmatrix}
\beta^\mathrm{real}_1   	& \cdots   & 0 \\
\vdots         			    & \ddots   & \vdots       \\
0              			&  \cdots  & \beta^\mathrm{real}_K \\
\end{pmatrix}
\begin{pmatrix}
\left| h_1 \right| e^{j \phi_1} \\
\vdots \\
\left| h_K \right| e^{j \phi_K}
\end{pmatrix}.
\end{align}

From (<ref>), we note that when the randomization scheme in Section <ref> is used for CSI obfuscation, its effect can be removed via . Essentially, the restored CSI magnitudes $ \left| h_k \right| $ are scaled by $ \beta^{\mathrm{real}}_k $ but the phases $ \phi_k $ remain unaffected. As a result, an adversary can extract the radiometric fingerprint $ \boldsymbol{\epsilon} $ (defined in (<ref>)) from the restored CSI phase $ \boldsymbol{\Phi} $. In order to prevent this outcome that infringes secrecy, a specific type of probability density function is required that prevents CSI denoising from collected measurements. This aspect is elaborated thoroughly in Section <ref>.

§.§ Takeaway

Any system relying on randomization for improving security/privacy should prove robust against statistical attacks. Here we propose  to assess the vulnerability of fingerprint randomization against these attacks. This tool will be later used to demonstrate the robustness of our proposed fingerprint obfuscation method (i.e., ) against statistical attacks. Furthermore, we analyze the statistical rationale behind the aforementioned vulnerability. This analysis is then leveraged to devise suitable countermeasures in the next section.

§ RF-VEIL: A PRIVACY- AND SECURITY-PRESERVING SOLUTION FOR RADIOMETRIC FINGERPRINTING

Schematic overview of an  transmitter and receiver. The flow-diagram in the center depicts the WiFi connection establishment and data exchange procedure (changes due to  marked in red color). The ACK messages are not shown in the figure for readability. They are not modified in .

In this section, we introduce our proposed technique , which injects crafted artificial noise to fingerprints in order to improve the robustness of WiFi transmissions against statistical attacks aiming at fingerprint acquisition.
In fig_algStructure, we illustrate the building blocks of . Note that, in  mode, we only need a subset of the blocks at the transmitter since the receiver does not perform any radiometric fingerprinting. To avoid repetition, we highlight the -specific blocks and the algorithm workflow in this mode in ss:standalone.

A short overview of . As shown in Fig. <ref>, the transmitter uses a random number generator to generate a pattern that obfuscates its radiometric fingerprint on a per-frame basis. The random number generator follows a specific distribution that is robust against statistical attacks. The receiver requires the seed to the random generator in order to generate the same pattern, which is used for CSI denoising and fingerprint extraction. The details about standard compliancy, random sequence generation, and key exchange are elaborated below.

§.§ Association

In WiFi, every new device first associates to the AP upon arrival to the network.
This includes exchanging the probe, authentication, and association request and response messages.
It is within this stage that the AP and the device establish a secure connection. In , we require the access point and the client to exchange one more key, which is used as one of the inputs to the random number generator, as shown in fig_rand_overview. We choose to use a pre-shared key due to ease of implementation.
However, one can leverage alternative secret key extraction methods that rely on channel response <cit.>.
As a result, the receiver and transmitter do not require a security handshake in advance but use physical layer information to generate the secret keys.

At this stage, the AP can extract the real fingerprint of the client after obtaining the shared key. We elaborate further on this in Section <ref>.

§.§ Obfuscation at the transmitter

The main task of the transmitter consists in obfuscation, as depicted on the left-hand side in fig_algStructure. For every frame, a random sequence is generated using the pre-shared key and the synchronization index.

Pre-shared key. In our implementation, we used a 128-bit key, which is refreshed every time the device re-associates with the AP. As a privacy protection measure, we obfuscate the fingerprint even before the association with an AP takes place. Hence, any frame transmitted from the devices (e.g., beacon, discovery) has an obfuscated fingerprint. In this case, it is advised to generate a new key periodically in order to protect against statistical attacks (see Section <ref> ). We leave the frequency of key renewal as a design choice. Since renewing the pre-shared key does not impose considerable overhead, we suggest to lean towards higher security.

Synchronization index.
Attaching a synchronization index to each frame has two purposes: (i) synchronize the random generator between the receiver and the transmitter and (ii) protect the receiver from replay attacks.
The synchronization is important because the pre-shared key only ensures that the random generators at both ends produce the same string of random numbers.
However, if a frame is lost, then the receiver may try to de-obfuscate the frame with the wrong pattern.
To prevent this, we attach an index for each frame, so that the receiver can use this index in combination with the pre-shared key to generate a synchronized and secure randomization pattern.
We intentionally refrained from using the existing 12-bit MAC frame sequence number due to its vulnerability to replay attacks.
Even at low data rates, the 12-bit sequence number resets within seconds, whereas our 32-bit sequence number takes 24 days to reset at the rate of 1000 frames per second.
We expect the WiFi connection to be re-initiated within such an interval.
Even though the exposure of this synchronization index does not expose legitimate users to security threats, it can still be abused for tracking.
Therefore, we encrypt this index with the pre-shared key via XOR operations.
We further discuss this approach in s_discus.

Once the obfuscation pattern is generated for all subcarriers, the symbols of the regular WiFi transmitter are rotated accordingly. The frame sequence number is then updated for the next frame and stored in a LUT. Finally, the symbols with phase rotations can be sent out over the air. However, one question still remains:  how do we ensure robustness against statistical attacks?

Robustness against statistical attacks. In Section <ref>, we showed experimentally and analytically that obfuscation with symmetric zero-mean distributions is susceptible to statistical attacks. Recalling the analysis therein, a robust distribution against such attacks should have the following properties.

\boxed{
\quad \left( \mathrm{\mathbf{P_1}} \right): f_{Z} \big( z \big) \geq 0 \quad \left( \mathrm{\mathbf{P_2}} \right): \int_{-\infty}^{\infty} f_{Z} \big( z \big) d z = 1 \quad \left( \mathrm{\mathbf{P_3}} \right): f_{Z} \big( z \big) \neq f_{Z} \big( -z \big) \quad \left( \mathrm{\mathbf{P_4}} \right): \mathbb{E} \left[ f_{Z} \big( z \big) \right] \neq 0 \quad

Essentially, $ \left( \mathrm{\mathbf{P_1}} \right) $ and $ \left( \mathrm{\mathbf{P_2}} \right) $ are inherent properties of all probability density functions, i.e., they are non-negative, and the total area under the graph $ f_{Z} \big( z \big) $ is equal to unity. On the one hand, $ \left( \mathrm{\mathbf{P_3}} \right) $ requires the probability density function to be non-symmetric while $ \left( \mathrm{\mathbf{P_4}} \right) $ states that it must not be centered around zero. These properties ensure that the effect of the random phase rotations will prevail even if a statistical attack is perpetrated. In Section <ref>, we corroborate experimentally that probability density functions complying with $ \left( \mathrm{\mathbf{P_1}} \right) $, $ \left( \mathrm{\mathbf{P_2}} \right) $, $ \left( \mathrm{\mathbf{P_3}} \right) $ and $ \left( \mathrm{\mathbf{P_4}} \right) $ can conceal the radiometric fingerprint effectively.

In the following, we justify the necessity for $ \left( \mathrm{\mathbf{P_3}} \right) $ and $ \left( \mathrm{\mathbf{P_4}} \right) $.  From (<ref>), we note that $ \mathbb{E} \left[ e^{j Z_k} \right] = \beta^{\mathrm{real}}_k + j \beta^{\mathrm{imag}}_k $ must be complex-valued in order to prevent the phase randomization effect from being removed. This is attained when the term $ \beta^{\mathrm{imag}}_k = \int_{-R_k}^{R_k} \cos \big( z_k \big) f'_{Z_k} \big( z_k \big) d z_k \neq 0 $, which produces a non-zero phase shift that is absorbed by the CSI phase thus concealing the fingerprint. In order for this to hold, $ \cos \big( z_k \big) f'_{Z_k} \big( z_k \big) $ must not be an odd function according to Corollary 3. Since $ \cos \big( z_k \big) $ is an even function, this also signifies that $ f'_{Z_k} \big( z_k \big) $ must not be an odd function according to Corollary 2. Via Corollary 1, this requirement is satisfied when $ f_{Z_k} \big( z_k \big) $ is not an even function. Therefore, it is revealed that we can design arbitrary probability density functions $ f_{Z_k} \big( z_k \big) $ that are not even with non-zero mean, thus yielding the desired effect that prevents phase randomization removal.

A simple yet effective manner to meet the above criteria is using a shifted even probability density function (e.g., shifted Gaussian or uniform distribution). We will experimentally prove that in ss:algo_performance.

§.§ De-obfuscation and authentication at the receiver

The right-hand side of fig_algStructure shows the two main tasks of the receiver: de-obfuscation and authentication.

De-obfuscation. Having the synchronization index and pre-shared key, the receiver can re-generate the obfuscation pattern (i.e., randomized phase rotations) of the transmitted frame. This allows the receiver to extract the original fingerprint. This is done easily by subtracting the obfuscation pattern from the phase of the received signal.

Authentication. The receiver verifies the restored fingerprint against the original fingerprint of the transmitter to authenticate the received frame. In addition, the receiver verifies that the synchronization index is larger than that in the last received frame. A frame whose synchronization index is less than or equal to the last frame is probably sent from an adversary attempting a replay attack. We highlight that with , WiFi devices can always obfuscate their fingerprint.  We mentioned in Section <ref> that  is designed such that obfuscation does not impact the communication performance. Hence, user privacy is always ensured through fingerprint concealment.

§.§  mode

In this mode, we allow the transmitting device to hide its fingerprint by executing the obfuscation blocks without any handshake or coordination with other receivers. Specifically, the device generates locally a synchronization index and the key, which are used as inputs for fingerprint obfuscation, as depicted in the transmitter side of fig_algStructure. As a result, we can ensure privacy protection in a much broader scenario, e.g., communicating with non--enabled devices, in absence of any active connections, or in connection establishment phase.

§.§ SDR implementation

We have implemented  using the USRP 2954R SDR platform. A simplified overview of the hardware used in our setup is depicted in fig_setup.
Each USRP is connected via PCI-e interface to a host machine running NI-Linux RT (kernel version 4.1.13-rt15-nilrt).
We build   using NI 802.11 application framework (AFW) [http://www.ni.com/pdf/manuals/376779f.pdf], which provides the physical layer and lower MAC layer functions in the FPGA, while the rest of the MAC procedures run at the host (Linux RT in our setup).
We provide a detailed overview of the existing implementation in Appendix <ref>.
Due to space constraints, we do not delve into the SDR implementation details. Our implementation and data is available online[https://github.com/seemoo-lab/RF-Veil].
The following briefly describes the setup.

Schematic overview of the hardware setup.

Fingerprint extraction at the receiver.
The physical layer implementation of 802.11 AFW already includes CSI estimation in the FPGA. For our implementation, we have transferred the CSI from the FPGA to the host via a T2H FIFO on a per-frame basis. This enables fast prototyping while maintaining real-time operation of the testbed. Having the CSI, we implemented the radiometric fingerprinting using non-linear phase errors, as described in Section <ref>.

Fingerprint modification at the transmitter.
These are required modifications at both the FPGA and the host. At the host, we compute the obfuscation pattern, which is sent to the FPGA on a per-frame basis. We made use of the interprocess communication protocol by NI to send packets containing the additional phase rotations. Then, we modified the transmitter chain at the FPGA to read the obfuscation pattern and  multiply each outgoing symbol with the corresponding phase rotations.

This increases the latency of the transmission chain by 5 clock cycles (12.5 ns).

Secure fingerprinting.
We implement  on top of the Fingerprint Extraction and Fingerprint Modification modules on the host.
We extend the packet headers so as to also carry the 32-bit synchronization index chosen at the transmitter.
When a new packet is being prepared for transmission, the MAC header is used to obtain the key and synchronization index from the LUT.
Then, the obfuscation pattern is generated using the key and synchronization index.

This pattern serves as input for the Fingerprint Modification module, which then pushes the values to the PHY.

At the receiver side, the CSI is written into the T2H Channel Estimation FIFO at the PHY.
The frame reception continues on the FPGA while the implementation of  runs on the output of the FIFO at the host.
After the information for random pattern generation is obtained, and the randomization is reverted, the fingerprint is calculated by the Fingerprint Extraction module.
The obtained fingerprint is then passed to the Matcher to be compared with the original fingerprint for authentication.

§.§ Takeaway

In this section, we elaborated on the workings behind  and its standalone-mode.
We devised the idea of synchronized obfuscation with special probability density functions to counter the statistical attacks introduced in Vulnerability_analysis, as well as the tracking and impersonation attacks introduced in s_adversary_model.
The prototype implementation of  on a USRP SDR platform enables us to experimentally evaluate the performance of our approach.
The takeaway message is that  introduces low overhead to the existing WiFi message flow while providing enhanced privacy for users and a secure way of physical layer device identification.

§ EVALUATION

In this section, we first evaluate the efficacy of the impersonation attack introduced in s_adversary_model.
We then leverage  to provide a broader assessment of the performance of naive randomization (i.e., obfuscation via zero-mean distributions) and  against statistical attacks.

§.§ Performance of naive randomization

In Section <ref>, we demonstrated the vulnerability of obfuscation, with zero-mean distributions, to statistical attacks experimentally and analytically. In particular, we showed that an adversary can easily restore the original fingerprint from 10000 frames. However, we have neither studied the impact of number of samples, nor considered the effect of the distributions variance on the accuracy of the restored fingerprint by the adversary. To this aim, in fig:zero_mean_mae, we show the mean absolute error (MAE) of the adversary's estimate of the original fingerprint when using  in 802.11ac.
The figure demonstrates the results under four distributions, namely, uniform, Gaussian, Laplacian, and triangular. For each distribution, we compute the MAE with four variances. Here we make two key observations: (i)  the adversary can restore the original fingerprint with very high accuracy by just processing the CSI of $\sim$2000 frames (a couple of seconds[In estimating the time for collecting a given number of frames, we assume that the user transmits at $\sim$ 8Mbps. This number is referential and intendeds to provide an estimate of how fast an adversary can mount an statistical attack.]), and (ii) the CSI-recovery error increases with the variance of randomization since larger variance leads to higher entropy of the obfuscated fingerprints. This behavior is mainly observed when the number of samples is low. As more samples are processed, the estimation error converges to nearly the same value (this is also supported by equation (<ref>) in Appendix <ref>). Nonetheless, an adversary can still obtain accurate estimates of the original fingerprint with negligible error even when distributions with large variances are employed. For instance, with only 1000 CSI samples, the MAE is below 3$^{\circ} $ for distributions with a variance of 60 deg$^2$. For small variances such as $ \xi^2 = $ 5$~\text{deg}^2$, with only 500 samples (roughly 0.5 seconds), the estimation error is consistently below 1$^{\circ} $ for all distributions. We observe a similar trend with 802.11a, whose results are available in Appendix <ref>.

Remarks: We have shown experimentally that the effect of naive randomization can be removed if an attacker is capable of collecting a few thousand samples to mount an statistical attack. Thus, naive randomization does not protect the fingerprint of devices.

§.§  performance

In this experiment, we evaluate the security and privacy enhancement achieved by . Following the conditions for randomization patterns that are robust to statistical attacks (see Section <ref>), we obfuscate the original signature of the device using the same four distributions whose mean values are now shifted according to a random pattern, unlike the previous experiment.
The results of this experiment in legacy mode 802.11a are provided in Appendix <ref>.
As depicted in fig:non_zero_mean, the recovered fingerprints using  deviate from the original fingerprint substantially and follow the course of a random pattern.
Essentially, when an adversary uses statistical analysis to identify devices, the extracted fingerprint will  not match with the original fingerprint. To shed light on this aspect, fig:non_zero_mean_mae depicts the MAE of fingerprints restored by  with increasing sample sizes and under different variances. As compared to the low MAE in fig:zero_mean_mae (3$^{\circ}$) where zero-mean distributions are used, the MAE in fig:non_zero_mean_mae increases approximately by 4-fold (13$^{\circ}$) regardless of the variances and sample sizes used. While all the variances lead to nearly the same error when $ N $ is large, we observe that a large variance produces more variability in the MAE, specially with a small number of samples $ N $. On the other hand, small variances produce a more condensed range of MAE values throughout all $ N $. This result demonstrates two promising properties of : (i) the adversary's estimate does not improve even with large number of samples, and (ii) the impact of the variance on estimation is almost negligible as all the errors converge to a similar value (also supported by equation (<ref>) in Appendix <ref>). Note that the random pattern in fig:non_zero_mean is generated approximately within the same phase-error range as the original fingerprint (i.e., between $ -25^{\circ} $ and $ 40^{\circ} $). Therefore, the attained MAE is not excessively large. However, the MAE can be arbitrarily larger if we construct the pattern spanning a wider range.

Remarks:  protects users' privacy by preventing adversaries from estimating the original fingerprint for tracking/locating the user. Furthermore, the security is also enhanced, since the adversary cannot successfully forge the original fingerprints of other devices.

Effect of  on throughput.
In Section <ref>, we analytically showed that  does not impact the throughput of WiFi communication. Here, we confirm our analysis with experiments.

We design an experiment in which we measure the throughput of two WiFi devices at different distances (up to 20m) and under distinct MCS (up to 64 QAM) with/without . fig_throughput_measurement demonstrates that  does not impact the throughput of the system, thus confirming our analysis. This is because the fingerprint obfuscation of  is based only on phase rotations of the I/Q symbols within a frame. In particular, such rotations do not affect the WiFi channel estimation since their effect is removed at the legitimate receivers. In the figure, we only show the result of obfuscation with uniform random distribution with $\xi^2 = 60^\circ$. However, we report that the other random distributions (Gaussian, Laplacian, and triangular) do neither impact the throughput. In this experiment, we also measured the computational overhead of . Our measurements show that  has an average execution time of 49.495 microseconds, even though we implemented most parts of  on the host (i.e., a windows machine). We expect the execution time to drop by at least an order of magnitude in real-time kernel or FPGA implementation.

Remark:  has low computational overhead and does not impact the communication quality.

§ DISCUSSION

In this section, we discuss some of the practical aspects of .

To share or not to share?
For the secure CSI-denoising when using , we use a symmetric shared key as it provides the easiest way of synchronizing the random number generators at the transmitter and receiver.
Furthermore, the synchronization index can be easily encrypted by XOR-ing the index with the shared key.
An alternative to the key exchange we use in ss_assoc is a key extraction mechanism based on physical layer properties, such as <cit.>.
This key extraction method leverages channel response information at the transmitter and receiver to generate symmetric keys.
Note that  is compatible with both methods. Regardless of the method, the key should be renewed at certain intervals, which brings us to the next point in our discussion.

How often should we renew the key?
The monotonically increasing 32-bit synchronization index ensures that, even if the transmitter keeps the symmetric key static for a certain time, they do not repeat the pattern of phase rotations.
If the synchronization index wraps around at its maximum of $2^{32}=4\,294\,967\,296$, the pattern of random phase rotations is repeated, and an adversary can potentially launch a replay attack.
In order to thwart such an attack, the key has to be renewed before the transmitter starts to re-use their synchronization indices for this key.
Furthermore, it is important to point out that the transmitter initializes the synchronization index with a number between $0$ and $2\,147\,483\,648$, which ensures that a part of the key cannot be guessed from the encrypted synchronization index in the frame.
We plot the minimum time for key refreshment under different transmission rates in fig_key_renewal_rates (for the worst case in which the transmitter chose to start at $2\,147\,483\,648$).
We observe that the key has to be refreshed every $596$ hours ($24.8$ days), assuming an average of $1000$ packets per second.
Even if we assume that the transmitter sends on average $25\,000$ packets per second, which would imply a rate of $462.4$ Mbps, it will exhaust the number of available synchronization indices in $23.8$ hours. Thus, even at very high rates ($5$ TByte of traffic per day), the key exchange is not too frequent.
Note that increasing the frequency of key exchange does not decrease the security level but increase the overhead since the keys are either transmitted encrypted by WPA2 or extracted by both transmitter and receiver using key extraction methods <cit.>. Subsequently, an exposure of this key would affect the privacy and security of the connection until a new key is exchanged.

Time to renew the key for different sending rates.

What if a frame is rejected?
A frame can be rejected for two different events: $(i)$ the calculated FCS of the frame does not match the actual FCS in the frame, and $(ii)$ the fingerprinting algorithm rejects the frame (e.g., the extracted fingerprint differs from the expected one).
In both cases, we let the MAC layer handle the re-transmission.
In the case of a rejected frame, an  transmitter does not re-use the synchronization index of the frame that is to be re-transmitted; instead, it increases the count as if a new frame was transmitted.
This is crucial to guarantee the security of the system as the encryption of the same synchronization index would lead to the same cipher-text.

What if a device is not yet connected?
If a device is not connected to an AP, it can still obfuscate its fingerprint by using  mode in order to lead a potential privacy-intruding adversary astray.
Once the device is connected to an AP and the pre-shared key has been established, it can switch into  mode, allowing the AP to securely extract the unrandomized fingerprint.
This same mechanism applies to the probe requests and acknowledgments in response to probe responses from APs during active scanning. Note that, when the device is not associated to an AP, it can simply use a random key.

How does an  transmitter communicate with a non- receiver?
Recalling s4, the obfuscation of fingerprints does not degrade the channel quality as the channel estimation and equalization at the receiver can handle the arbitrary phase shifts introduced by the transmitter. Specifically, the additional phase rotations are absorbed by the CSI, and as long as the same phase rotation pattern is used for all the subcarriers within the frame, the receiver will assume that such CSI is legitimate. Hence, a receiver that is not aware of  will simply revert the phase shifts together with the channel effects. In other words, a transmitter using the  mode can still communicate with a legacy receiver. This receiver, however, will not be able to extract the correct fingerprint of the transmitter.

Can we implement  on COTS devices? In recent years, a number of research groups have developed firmware modification/patching tools which allow manipulating MAC/PHY layer operations of the WiFi chipset. Although out of scope of this work, we believe that  can be implemented on COTS devices using such tools. In particular, Schulz et al. <cit.> demonstrate the feasibility of modifying IQ symbols in commercial APs equipped Broadcom chipsets using their firmware patching framework, i.e., nexmon[https://github.com/seemoo-lab/nexmon].

§ RELATED WORK

To date, we have not found any prior work on radiometric fingerprint obfuscation.
Prior works only focused on thwarting identification techniques that used packet metadata (frame size, data rate, inter-packet time, etc.) and friendly jamming <cit.>, upper-layer characteristics such as jitter of beacon timestamps <cit.>, rate switching mechanisms <cit.>, and under-specification of the MAC layer protocols and procedures <cit.>.
The proposed countermeasures for these upper-layer fingerprinting techniques consist of pattern randomization <cit.>, similar to ours. However, unlike , their approach eliminates the possibility of legitimate fingerprinting. Furthermore, the  solutions therein are not tested against statistical attacks.

In the following, we provide a broader overview of the radiometric fingerprinting solutions, which can be categorized into transient-based and  modulation-based approaches.

§.§ Transient-based approaches

The transient refers to the part of the signal in which the amplitude rises from background noise to full power <cit.>. Given its dependence on the hardware characteristics, a transient is a reliable feature for device identification by tracking the small but measurable differences in the turn-on transients.
This can, for example, include the duration of turn-on transient <cit.> or standard deviation of normalized amplitude, phase, and frequency <cit.>.
These approaches are cumbersome since they rely on the exact extraction of the transient portion of signals, which further depends on the channel noise. To ensure accurate and timely detection of the transient despite the channel noise, a very high sampling rate is required, which is typically achievable by high-end oscilloscopes (e.g., 4 Giga samples per second in <cit.>).

§.§ Modulation-based approaches

Modulation- or steady-state approaches, as the name suggests, make use of errors in the modulated signal.
The seminal work of Brik et al. <cit.> proposes to collect the fingerprints from five features of the modulated signal, that is, magnitude, phase and frequency error, I/Q origin offset, and SYNC correlation. They show experimentally that their solutions, called PARADIS, can differentiate among 130 identical IEEE 802.11b devices with an accuracy above 99% even under mobility and varying noise conditions. Similar to the transient-based approaches, their approach requires additional equipment since they rely on high-end vector analyzers for channel sampling. Motivated by their work, recent approaches <cit.> propose to use the CSI obtained from the pilot symbols which are readily available on WiFi chipsets, such as the Intel 5300 or Atheros AR9380. Specifically, Hua et al. <cit.> propose to compute the fingerprint using a combination of CFO extracted from the CSI and TDoA computed from capturing 5000 adjacent frames. Furthermore, they require the device to remain stationary for at least 10 seconds for authenticating a device based on the previously collected fingerprint. The most recent work on radiometric fingerprinting <cit.> makes use of the non-linear phase errors extracted from CSI. Their work takes advantage of non-linear phase error extraction methods proposed by Zhuo et al. in <cit.>. In this paper, we work toward obfuscating the radiometric fingerprints caused by non-linear phase errors <cit.> since it neither relies on RF equipment with very high sampling rates nor requires large number of frames or stationary user behavior for fingerprinting. Nonetheless, 's approach can be extended to other features of the signal, which is controllable at the chipset, such as CFO and amplitude.

§ CONCLUSIONS

Radiometric fingerprinting is typically considered a secure method for device identification <cit.>. In this paper, we first demonstrate the vulnerability of the latest CSI-based radiometric identification schemes to impersonation attacks, which emphasizes the need for fingerprinting solutions that are robust against adversarial attacks on user security and privacy. We also illustrate that a naive fingerprint-randomization approach does not withhold adversaries capable of mounting statistical attacks (i.e.,  in this paper). Consequently, we devise , a framework that enhances user privacy against fingerprint-based tracking/localization attacks, and is robust to statistical, impersonation, and replay attacks.

To the best of our knowledge, this is the first article that addresses the vulnerabilities of radiometric fingerprints. Hence, we foresee a few avenues of research as future work.
Leveraging the randomization patterns to create a side-channel between the receiver and transmitter is an interesting method for exchanging the synchronization index. Furthermore, extending  to support MIMO transmissions or other signal characteristics such as CFO is another direction to further enhance user privacy. Randomizing the STFs and its impact on the communication and radiometric fingerprints is also an interesting research avenue. Further, investigating new distributions functions for the phase rotations that not only preserve security and communication but also reduce the peak-to-average power ratio is an interest research direction, especially for achieving high energy efficiency in low-power IoT devices.

This research is conducted in the context of the DFG-funded project SenShield (447586980). This work is in part supported by the B5G-Cell project in SFB 1053 MAKI and by the LOEWE initiative (Hesse, Germany) within the emergenCITY center. We would like to thank Clemens Felber and Dr. Walter P. Nitzold from NI, Dresden, for their valuable guidance in modification of WiFi LabVIEW AFW.

#1     #1#1#1     #1     #1     #1     #1#1          #1#1

[Abanto-Leon, Sim, Hollick, Boonkajay, and
AdachiAbanto-Leon et al2020]
authorpersonLuis F. Abanto-Leon, personGek
Hong (Allyson) Sim, personMatthias Hollick,
personAmnart Boonkajay, and personFumiyuki Adachi.
SWAN: Swarm-Based Low-Complexity Scheme for PAPR
Reduction. In booktitleIEEE GLOBECOM.

[Arackaparambil, Bratus, Shubina, and
KotzArackaparambil et al2010]
authorpersonChrisil Arackaparambil,
personSergey Bratus, personAnna Shubina, and
personDavid Kotz. year2010.
On the Reliability of Wireless Fingerprinting
using Clock Skews. In booktitleACM WiSec.

[Bellare and KohnoBellare and Kohno2004]
authorpersonMihir Bellare and
personTadayoshi Kohno. year2004.
Hash function balance and its impact on birthday
attacks. In booktitleInternational Conference on the Theory
and Applications of Cryptographic Techniques. Springer,

[Bratus, Cornelius, Kotz, and PeeblesBratus
et al2008]
authorpersonSergey Bratus, personCory
Cornelius, personDavid Kotz, and personDaniel
Peebles. year2008.
Active Behavioral Fingerprinting of Wireless
Devices. In booktitleACM WiSec. pages56–61.

[Brik, Banerjee, Gruteser, and OhBrik
et al2008]
authorpersonVladimir Brik, personSuman
Banerjee, personMarco Gruteser, and personSangho
Oh. year2008.
Wireless Device Identification with Radiometric
Signatures. In booktitleACM MobiCom.

authorpersonJohnny Cache.
titleFingerprinting 802.11 Devices.
thesistypePh.D. Dissertation. schoolNaval
Postgraduate School.

[Cermak, Svorencik, Lipovsky, and
KubovicCermak et al2020]
authorpersonMilos Cermak, personStefan
Svorencik, personRobert Lipovsky, and personOndrej
Kubovic. year2020.
booktitleKR00K - CVE-2019-15126.
typeTechnical Report. institutionESET.

[Cominelli, Kosterhon, Gringoli, Cigno, and
AsadiCominelli et al2020]
authorpersonMarco Cominelli, personFelix
Kosterhon, personFrancesco Gringoli, personRenato Lo
Cigno, and personArash Asadi.
An Experimental Study of CSI Management to
Preserve Location Privacy. In booktitleACM WiNTECH.

[Corbett, Beyah, and CopelandCorbett
et al2008]
authorpersonCherita L Corbett,
personRaheem A Beyah, and personJohn A Copeland.
Passive Classification of Wireless NICs during
Active Scanning.
journalInternational Journal of Information
Security volume7, number5 (year2008),

[D'Andrea, Mengali, and ReggianniniD'Andrea
et al1994]
authorpersonA. N. D'Andrea, personU.
Mengali, and personR. Reggiannini.
The Modified Cramer-Rao Bound and its Application
to Synchronization Problems.
journalIEEE Transactions on Communications
volume42, number234 (dateFeb
year1994), pages1391–1399.

[Danev and CapkunDanev and Capkun2009]
authorpersonBoris Danev and personSrdjan
Capkun. year2009.
Transient-based Identification of Wireless Sensor
Nodes. In booktitleACM IPSN. pages25–36.

[Fluhrer, Mantin, and ShamirFluhrer
et al2001]
authorpersonScott Fluhrer, personItsik
Mantin, and personAdi Shamir.
Weaknesses in the Key Scheduling Algorithm of
RC4. In booktitleSAC. publisherSpringer
Berlin Heidelberg, pages1–24.

authorpersonRobert M. Gray.
Toeplitz and Circulant Matrices: A Review.
journalFoundations and Trends® in Communications
and Information Theory volume2, number3
(year2006), pages155–239.

[Gringoli, Schulz, Link, and HollickGringoli
et al2019]
authorpersonFrancesco Gringoli,
personMatthias Schulz, personJakob Link, and
personMatthias Hollick. year2019.
Free Your CSI: A Channel State Information
Extraction Platform For Modern Wi-Fi Chipsets. In
booktitleACM WiNTECH. pages21–28.

[Gruteser and GrunwaldGruteser and
authorpersonMarco Gruteser and personDirk
Grunwald. year2005.
Enhancing Location Privacy in Wireless LAN through
Disposable Interface Identifiers: A Quantitative Analysis.
journalMobile Networks and Applications
volume10, number3 (year2005),

[Hall, Barbeau, and KranakisHall
et al2004]
authorpersonJeyanthi Hall, personMichel
Barbeau, and personEvangelos Kranakis.
Enhancing intrusion detection in wireless networks
using radio frequency fingerprinting.
journalICCIIT, pages1–6.

[Halperin, Hu, Sheth, and WetherallHalperin
et al2011]
authorpersonDaniel Halperin, personWenjun
Hu, personAnmol Sheth, and personDavid Wetherall.
Tool Release: Gathering 802.11 n Traces with
Channel State Information.
journalACM SIGCOMM volume41,
number1 (dateJan year2011),

[Hua, Sun, Shen, Qian, and ZhongHua
et al2018]
authorpersonJingyu Hua, personHongyi Sun,
personZhenyu Shen, personZhiyun Qian, and
personSheng Zhong. year2018.
Accurate and Efficient Wireless Device
Fingerprinting Using Channel State Information. In
booktitleIEEE INFOCOM. pages1700–1708.

[Jafarian, Niakanlahiji, Al-Shaer, and
DuanJafarian et al2016]
authorpersonJafar Haadi Jafarian,
personAmirreza Niakanlahiji, personEhab Al-Shaer,
and personQi Duan. year2016.
Multi-Dimensional Host Identity Anonymization for
Defeating Skilled Attackers. In booktitleProceedings of
the 2016 ACM Workshop on Moving Target Defense. pages47–58.

authorpersonSteven M. Kay.
booktitleFundamentals of Statistical Signal
Processing, Volume I: Estimation Theory.
publisherPrentice Hall.

[Li, Yu, Xing, and HuLi
et al2019]
authorpersonGuyue Li, personJiabao Yu,
personYuexiu Xing, and personAiqun Hu.
Location-Invariant Physical Layer Identification
Approach for WiFi Devices.
journalIEEE Access  volume7
(dateAug year2019), pages106974–106986.

[Liu, Wang, Yang, and ChenLiu
et al2013]
authorpersonHongbo Liu, personYang Wang,
personJie Yang, and personYingying Chen.
Fast and Practical Secret Key Extraction by
Exploiting Channel Response. In booktitleIEEE INFOCOM.

[Liu, Yang, Song, Yan, and LiLiu
et al2019]
authorpersonP. Liu, personP. Yang,
personW. Song, personY. Yan, and
personX. Li. year2019.
Real-time Identification of Rogue WiFi Connections
Using Environment-Independent Physical Features. In
booktitleIEEE INFOCOM. pages190–198.

[Miller and ChangMiller and Chang1978]
authorpersonR. Miller and personC. B.
Chang. year1978.
A modified Cramér-Rao bound and its applications
journalIEEE Transactions on Information Theory
volume24, number3 (dateMay
year1978), pages398–400.

[Oh, Vu, Gruteser, and BanerjeeOh
et al2012]
authorpersonSangho Oh, personTam Vu,
personMarco Gruteser, and personSuman Banerjee.
Phantom: Physical Layer Cooperation for Location
Privacy Protection. In booktitleIEEE INFOCOM.

[Qiao, Zhang, Zhou, Srinivasan, and AroraQiao
et al2016]
authorpersonYue Qiao, personOuyang Zhang,
personWenjie Zhou, personKannan Srinivasan, and
personAnish Arora. year2016.
PhyCloak: Obfuscating Sensing from Communication
Signals. In booktitleUSENIX NSDI.

[Rahbari and KrunzRahbari and Krunz2014]
authorpersonHanif Rahbari and personMarwan
Krunz. year2014.
Friendly CryptoJam: A Mechanism for Securing
Physical-layer Attributes. In booktitleProceedings of the
2014 ACM conference on Security and privacy in wireless & mobile networks.

[Rahbari and KrunzRahbari and Krunz2015a]
authorpersonHanif Rahbari and personMarwan
Krunz. year2015a.
Secrecy Beyond Encryption: Obfuscating
Transmission Signatures in Wireless Communications.
journalIEEE Communications Magazine
volume53, number12 (year2015),

[Rahbari and KrunzRahbari and Krunz2015b]
authorpersonHanif Rahbari and personMarwan
Krunz. year2015b.
Secrecy beyond encryption: obfuscating transmission
signatures in wireless communications.
journalIEEE Communications Magazine
volume53, number12 (year2015),

[Rasmussen and CapkunRasmussen and
authorpersonKasper Bonne Rasmussen and
personSrdjan Capkun. year2007.
Implications of Radio Fingerprinting on the
Security of Sensor Networks. In booktitleEAI SecureComm.

[Robyns, Bonné, Quax, and LamotteRobyns
et al2017]
authorpersonPieter Robyns, personBram
Bonné, personPeter Quax, and personWim
Lamotte. year2017.
Noncooperative 802.11 MAC Layer Fingerprinting and
Tracking of Mobile Devices.
journalSecurity and Communication Networks

[Schmidl and CoxSchmidl and Cox1997]
authorpersonT M Schmidl and personD C
Cox. year1997.
Robust frequency and timing synchronization for
journalIEEE Transactions on Communications
volume45, number12 (year1997),

[Schulz, Link, Gringoli, and HollickSchulz
et al2018]
authorpersonMatthias Schulz, personJakob
Link, personFrancesco Gringoli, and personMatthias
Hollick. year2018.
Shadow Wi-Fi: Teaching Smartphones to Transmit Raw
Signals and to Extract Channel State Information to Implement Practical
Covert Channels over Wi-Fi.
(dateJun year2018),

[Schulz, Wegemer, and HollickSchulz
et al2017]
authorpersonMatthias Schulz, personDaniel
Wegemer, and personMatthias Hollick.
titleNexmon: The C-based Firmware Patching Framework.

authorpersonIEEE Computer Society.
booktitle802.11-2016: Wireless LAN Medium Access
Control (MAC) and Physical Layer (PHY) Specifications.
typeTechnical Report. institutionIEEE.

[Vanhoef, Matte, Cunche, Cardoso, and
PiessensVanhoef et al2016]
authorpersonMathy Vanhoef,
personCélestin Matte, personMathieu Cunche,
personLeonardo S Cardoso, and personFrank
Piessens. year2016.
Why MAC Address randomization Is Not Enough: An
Analysis of Wi-Fi Network Discovery Mechanisms. In
booktitleProceedings of the 11th ACM on Asia Conference on
Computer and Communications Security. pages413–424.

[Vanhoef and PiessensVanhoef and
authorpersonMathy Vanhoef and personFrank
Piessens. year2017.
Key Reinstallation Attacks: Forcing Nonce Reuse in
WPA2. In booktitleCCS ACM SIGSAC.

[Xie, Li, and LiXie et al2018]
authorpersonYaxiong Xie, personZhenjiang
Li, and personMo Li. year2018.
Precise Power Delay Profiling with Commodity
journalIEEE Transactions on Mobile Computing
volume18, number6 (dateSep
year2018), pages1342–1355.

[Xu, Zheng, Saad, and HanXu
et al2015]
authorpersonQiang Xu, personRong Zheng,
personWalid Saad, and personZhu Han.
Device Fingerprinting in Wireless Networks:
Challenges and Opportunities.
journalIEEE Communications Surveys & Tutorials
volume18, number1 (year2015),

[Yao, Li, Liu, Chi, Wang, Xie, and ZhuYao
et al2018]
authorpersonYao Yao, personYan Li,
personXin Liu, personZicheng Chi,
personWei Wang, personTiantian Xie, and
personTing Zhu. year2018.
Aegis: An Interference-negligible RF Sensing
Shield. In booktitleIEEE INFOCOM.

[Zhuo, Zhu, Xue, and ChangZhuo
et al2017]
authorpersonYiwei Zhuo, personHongzi Zhu,
personHua Xue, and personShan Chang.
Perceiving Accurate CSI Phases with Commodity WiFi
Devices. In booktitleIEEE INFOCOM.

#1     #1#1#1     #1     #1     #1     #1#1          #1#1

[Abanto-Leon, Sim, Hollick, Boonkajay, and
AdachiAbanto-Leon et al2020]
authorpersonLuis F. Abanto-Leon, personGek
Hong (Allyson) Sim, personMatthias Hollick,
personAmnart Boonkajay, and personFumiyuki Adachi.
SWAN: Swarm-Based Low-Complexity Scheme for PAPR
Reduction. In booktitleIEEE GLOBECOM.

[Arackaparambil, Bratus, Shubina, and
KotzArackaparambil et al2010]
authorpersonChrisil Arackaparambil,
personSergey Bratus, personAnna Shubina, and
personDavid Kotz. year2010.
On the Reliability of Wireless Fingerprinting
using Clock Skews. In booktitleACM WiSec.

[Bellare and KohnoBellare and Kohno2004]
authorpersonMihir Bellare and
personTadayoshi Kohno. year2004.
Hash function balance and its impact on birthday
attacks. In booktitleInternational Conference on the Theory
and Applications of Cryptographic Techniques. Springer,

[Bratus, Cornelius, Kotz, and PeeblesBratus
et al2008]
authorpersonSergey Bratus, personCory
Cornelius, personDavid Kotz, and personDaniel
Peebles. year2008.
Active Behavioral Fingerprinting of Wireless
Devices. In booktitleACM WiSec. pages56–61.

[Brik, Banerjee, Gruteser, and OhBrik
et al2008]
authorpersonVladimir Brik, personSuman
Banerjee, personMarco Gruteser, and personSangho
Oh. year2008.
Wireless Device Identification with Radiometric
Signatures. In booktitleACM MobiCom.

authorpersonJohnny Cache.
titleFingerprinting 802.11 Devices.
thesistypePh.D. Dissertation. schoolNaval
Postgraduate School.

[Cermak, Svorencik, Lipovsky, and
KubovicCermak et al2020]
authorpersonMilos Cermak, personStefan
Svorencik, personRobert Lipovsky, and personOndrej
Kubovic. year2020.
booktitleKR00K - CVE-2019-15126.
typeTechnical Report. institutionESET.

[Cominelli, Kosterhon, Gringoli, Cigno, and
AsadiCominelli et al2020]
authorpersonMarco Cominelli, personFelix
Kosterhon, personFrancesco Gringoli, personRenato Lo
Cigno, and personArash Asadi.
An Experimental Study of CSI Management to
Preserve Location Privacy. In booktitleACM WiNTECH.

[Corbett, Beyah, and CopelandCorbett
et al2008]
authorpersonCherita L Corbett,
personRaheem A Beyah, and personJohn A Copeland.
Passive Classification of Wireless NICs during
Active Scanning.
journalInternational Journal of Information
Security volume7, number5 (year2008),

[D'Andrea, Mengali, and ReggianniniD'Andrea
et al1994]
authorpersonA. N. D'Andrea, personU.
Mengali, and personR. Reggiannini.
The Modified Cramer-Rao Bound and its Application
to Synchronization Problems.
journalIEEE Transactions on Communications
volume42, number234 (dateFeb
year1994), pages1391–1399.

[Danev and CapkunDanev and Capkun2009]
authorpersonBoris Danev and personSrdjan
Capkun. year2009.
Transient-based Identification of Wireless Sensor
Nodes. In booktitleACM IPSN. pages25–36.

[Fluhrer, Mantin, and ShamirFluhrer
et al2001]
authorpersonScott Fluhrer, personItsik
Mantin, and personAdi Shamir.
Weaknesses in the Key Scheduling Algorithm of
RC4. In booktitleSAC. publisherSpringer
Berlin Heidelberg, pages1–24.

authorpersonRobert M. Gray.
Toeplitz and Circulant Matrices: A Review.
journalFoundations and Trends® in Communications
and Information Theory volume2, number3
(year2006), pages155–239.

[Gringoli, Schulz, Link, and HollickGringoli
et al2019]
authorpersonFrancesco Gringoli,
personMatthias Schulz, personJakob Link, and
personMatthias Hollick. year2019.
Free Your CSI: A Channel State Information
Extraction Platform For Modern Wi-Fi Chipsets. In
booktitleACM WiNTECH. pages21–28.

[Gruteser and GrunwaldGruteser and
authorpersonMarco Gruteser and personDirk
Grunwald. year2005.
Enhancing Location Privacy in Wireless LAN through
Disposable Interface Identifiers: A Quantitative Analysis.
journalMobile Networks and Applications
volume10, number3 (year2005),

[Hall, Barbeau, and KranakisHall
et al2004]
authorpersonJeyanthi Hall, personMichel
Barbeau, and personEvangelos Kranakis.
Enhancing intrusion detection in wireless networks
using radio frequency fingerprinting.
journalICCIIT, pages1–6.

[Halperin, Hu, Sheth, and WetherallHalperin
et al2011]
authorpersonDaniel Halperin, personWenjun
Hu, personAnmol Sheth, and personDavid Wetherall.
Tool Release: Gathering 802.11 n Traces with
Channel State Information.
journalACM SIGCOMM volume41,
number1 (dateJan year2011),

[Hua, Sun, Shen, Qian, and ZhongHua
et al2018]
authorpersonJingyu Hua, personHongyi Sun,
personZhenyu Shen, personZhiyun Qian, and
personSheng Zhong. year2018.
Accurate and Efficient Wireless Device
Fingerprinting Using Channel State Information. In
booktitleIEEE INFOCOM. pages1700–1708.

[Jafarian, Niakanlahiji, Al-Shaer, and
DuanJafarian et al2016]
authorpersonJafar Haadi Jafarian,
personAmirreza Niakanlahiji, personEhab Al-Shaer,
and personQi Duan. year2016.
Multi-Dimensional Host Identity Anonymization for
Defeating Skilled Attackers. In booktitleProceedings of
the 2016 ACM Workshop on Moving Target Defense. pages47–58.

authorpersonSteven M. Kay.
booktitleFundamentals of Statistical Signal
Processing, Volume I: Estimation Theory.
publisherPrentice Hall.

[Li, Yu, Xing, and HuLi
et al2019]
authorpersonGuyue Li, personJiabao Yu,
personYuexiu Xing, and personAiqun Hu.
Location-Invariant Physical Layer Identification
Approach for WiFi Devices.
journalIEEE Access  volume7
(dateAug year2019), pages106974–106986.

[Liu, Wang, Yang, and ChenLiu
et al2013]
authorpersonHongbo Liu, personYang Wang,
personJie Yang, and personYingying Chen.
Fast and Practical Secret Key Extraction by
Exploiting Channel Response. In booktitleIEEE INFOCOM.

[Liu, Yang, Song, Yan, and LiLiu
et al2019]
authorpersonP. Liu, personP. Yang,
personW. Song, personY. Yan, and
personX. Li. year2019.
Real-time Identification of Rogue WiFi Connections
Using Environment-Independent Physical Features. In
booktitleIEEE INFOCOM. pages190–198.

[Miller and ChangMiller and Chang1978]
authorpersonR. Miller and personC. B.
Chang. year1978.
A modified Cramér-Rao bound and its applications
journalIEEE Transactions on Information Theory
volume24, number3 (dateMay
year1978), pages398–400.

[Oh, Vu, Gruteser, and BanerjeeOh
et al2012]
authorpersonSangho Oh, personTam Vu,
personMarco Gruteser, and personSuman Banerjee.
Phantom: Physical Layer Cooperation for Location
Privacy Protection. In booktitleIEEE INFOCOM.

[Qiao, Zhang, Zhou, Srinivasan, and AroraQiao
et al2016]
authorpersonYue Qiao, personOuyang Zhang,
personWenjie Zhou, personKannan Srinivasan, and
personAnish Arora. year2016.
PhyCloak: Obfuscating Sensing from Communication
Signals. In booktitleUSENIX NSDI.

[Rahbari and KrunzRahbari and Krunz2014]
authorpersonHanif Rahbari and personMarwan
Krunz. year2014.
Friendly CryptoJam: A Mechanism for Securing
Physical-layer Attributes. In booktitleProceedings of the
2014 ACM conference on Security and privacy in wireless & mobile networks.

[Rahbari and KrunzRahbari and Krunz2015a]
authorpersonHanif Rahbari and personMarwan
Krunz. year2015a.
Secrecy Beyond Encryption: Obfuscating
Transmission Signatures in Wireless Communications.
journalIEEE Communications Magazine
volume53, number12 (year2015),

[Rahbari and KrunzRahbari and Krunz2015b]
authorpersonHanif Rahbari and personMarwan
Krunz. year2015b.
Secrecy beyond encryption: obfuscating transmission
signatures in wireless communications.
journalIEEE Communications Magazine
volume53, number12 (year2015),

[Rasmussen and CapkunRasmussen and
authorpersonKasper Bonne Rasmussen and
personSrdjan Capkun. year2007.
Implications of Radio Fingerprinting on the
Security of Sensor Networks. In booktitleEAI SecureComm.

[Robyns, Bonné, Quax, and LamotteRobyns
et al2017]
authorpersonPieter Robyns, personBram
Bonné, personPeter Quax, and personWim
Lamotte. year2017.
Noncooperative 802.11 MAC Layer Fingerprinting and
Tracking of Mobile Devices.
journalSecurity and Communication Networks

[Schmidl and CoxSchmidl and Cox1997]
authorpersonT M Schmidl and personD C
Cox. year1997.
Robust frequency and timing synchronization for
journalIEEE Transactions on Communications
volume45, number12 (year1997),

[Schulz, Link, Gringoli, and HollickSchulz
et al2018]
authorpersonMatthias Schulz, personJakob
Link, personFrancesco Gringoli, and personMatthias
Hollick. year2018.
Shadow Wi-Fi: Teaching Smartphones to Transmit Raw
Signals and to Extract Channel State Information to Implement Practical
Covert Channels over Wi-Fi.
(dateJun year2018),

[Schulz, Wegemer, and HollickSchulz
et al2017]
authorpersonMatthias Schulz, personDaniel
Wegemer, and personMatthias Hollick.
titleNexmon: The C-based Firmware Patching Framework.

authorpersonIEEE Computer Society.
booktitle802.11-2016: Wireless LAN Medium Access
Control (MAC) and Physical Layer (PHY) Specifications.
typeTechnical Report. institutionIEEE.

[Vanhoef, Matte, Cunche, Cardoso, and
PiessensVanhoef et al2016]
authorpersonMathy Vanhoef,
personCélestin Matte, personMathieu Cunche,
personLeonardo S Cardoso, and personFrank
Piessens. year2016.
Why MAC Address randomization Is Not Enough: An
Analysis of Wi-Fi Network Discovery Mechanisms. In
booktitleProceedings of the 11th ACM on Asia Conference on
Computer and Communications Security. pages413–424.

[Vanhoef and PiessensVanhoef and
authorpersonMathy Vanhoef and personFrank
Piessens. year2017.
Key Reinstallation Attacks: Forcing Nonce Reuse in
WPA2. In booktitleCCS ACM SIGSAC.

[Xie, Li, and LiXie et al2018]
authorpersonYaxiong Xie, personZhenjiang
Li, and personMo Li. year2018.
Precise Power Delay Profiling with Commodity
journalIEEE Transactions on Mobile Computing
volume18, number6 (dateSep
year2018), pages1342–1355.

[Xu, Zheng, Saad, and HanXu
et al2015]
authorpersonQiang Xu, personRong Zheng,
personWalid Saad, and personZhu Han.
Device Fingerprinting in Wireless Networks:
Challenges and Opportunities.
journalIEEE Communications Surveys & Tutorials
volume18, number1 (year2015),

[Yao, Li, Liu, Chi, Wang, Xie, and ZhuYao
et al2018]
authorpersonYao Yao, personYan Li,
personXin Liu, personZicheng Chi,
personWei Wang, personTiantian Xie, and
personTing Zhu. year2018.
Aegis: An Interference-negligible RF Sensing
Shield. In booktitleIEEE INFOCOM.

[Zhuo, Zhu, Xue, and ChangZhuo
et al2017]
authorpersonYiwei Zhuo, personHongzi Zhu,
personHua Xue, and personShan Chang.
Perceiving Accurate CSI Phases with Commodity WiFi
Devices. In booktitleIEEE INFOCOM.

§ KRONECKER PRODUCT PROPERTIES

Property 1 (Transpose of a Kronecker product):
Let ${\bf A} \in \mathbb{C}^{m \times n}$, ${\bf B} \in \mathbb{C}^{r \times s}$, then $ \left( \mathbf{A} \otimes \mathbf{B} \right)^T = \mathbf{A}^T \otimes \mathbf{B}^T $.

Property 2 (Product of two Kronecker products):
Let ${\bf A} \in \mathbb{C}^{m \times n}$, $ {\bf B} \in \mathbb{C}^{r \times s} $, $ {\bf C} \in \mathbb{C}^{n \times p}$, and ${\bf D} \in \mathbb{C}^{s \times t} $, then $ {\bf AB} \otimes {\bf CD} = ({\bf A} \otimes {\bf C})({\bf B} \otimes {\bf D}) $.

Property 3 (Trace of a Kronecker product of matrices):
Let ${\bf A} \in \mathbb{C}^{m \times m}$, ${\bf B} \in \mathbb{C}^{n \times n}$, then $ \mathrm{Tr} \big( \mathbf{A} \otimes \mathbf{B} \big) = \mathrm{Tr} \big( \mathbf{A} \big) \big( \mathbf{B} \big) $.

Property 4 (Cyclic permutation of the trace):
Let ${\bf A} \in \mathbb{C}^{m \times n}$, ${\bf B} \in \mathbb{C}^{n \times m}$, then 	$ \mathrm{Tr} \big( {\bf AB} \big) = \mathrm{Tr} \big( {\bf BA} \big) $.

Property 5 (Trace of a Kronecker product of vectors):
Let ${\bf a} \in \mathbb{C}^{m \times 1}$, ${\bf b} \in \mathbb{C}^{m \times 1}$, then $ \mathrm{Tr} \big( \mathbf{a} \otimes \mathbf{b}^T \big) = \mathrm{Tr} \big( \mathbf{a} \mathbf{b}^T \big) $.

§ CRAMER-RAO BOUND OF

We analyze the performance of  and compare it to the Cramer-Rao bound (CRB) bound. We show that  is a near-optimal estimator of the CSI, as defined in (<ref>). For notation simplicity and without loss of generality, in the sequel, we drop the subcarrier index $ k $ and consider the analysis for a single subcarrier for which $ N $ measurements are available.

Let $ m_n $ be a measurement (or observation) in a given subcarrier defined as

\begin{equation} \label{e-B1}
m_n = h e^{j Z_n} + w_n ,
\end{equation}

where $ Z_n $ is a random phase rotation and $ h $ is the complex-valued channel.  Recalling Section <ref>, $ Z_n $ is introduced by our proposed approach  to prevent attackers from acquiring the channel accurately. Thus, let $ p (m_n \mid Z_n; h) $ denote the joint likelihood function of $ Z_n $ and $ h $, given the observation $ m_n $

\begin{equation} \label{e-B2}
p (m_n \mid Z_n; h) = \frac{1}{\sqrt{\pi \sigma^2}} e^{ - \frac{1}{\sigma^2} \left| m_n - h e^{j Z_n} \right|^2 }.
\end{equation}

For $ N $ uncorrelated measurements, we have the likelihood function

\begin{equation} \label{e-B3}
p (m_1, \cdots, m_N \mid Z_1, \cdots, Z_N; h) = \Pi^N_{n = 1} \frac{1}{\sqrt{\pi \sigma^2}} e^{ - \frac{1}{\sigma^2} \left| m_n - h e^{j Z_n} \right|^2 },
\end{equation}

which can be equivalently recast as

\begin{equation} \label{e-B4}
p (\mathbf{m} \mid \mathbf{Z}; h) = \frac{1}{(\pi \sigma^2)^{N/2}} e^{ - \frac{1}{\sigma^2} \left\| \mathbf{m} - h e^{j \mathbf{Z}} \right\|^2_2  },
\end{equation}

where $ \mathbf{m} = \left[m_1, \cdots, m_N \right]^T $ and $ \mathbf{Z} = \left[Z_1, \cdots, Z_N \right]^T $. To compute the CRB of $ h $, we require the likelihood function $ p (\mathbf{m}; h) $. Note that this function can be obtained through averaging $ 	p (\mathbf{m} \mid \mathbf{Z}; h) $ over the random nuisance variables $ \mathbf{Z} $. Thus, the likelihood function $ p \left( \mathbf{m}; h\right) $ is computed as

\begin{equation} \label{e-B5}
\begin{split}
p (\mathbf{m}; h) & = \mathbb{E}_{\mathbf{Z}} \left[ \frac{1}{(\pi \sigma^2)^{N/2}} e^{ - \frac{1}{\sigma^2} \left\| \mathbf{m} - h e^{j \mathbf{Z}} \right\|^2_2  } \right], \\
& = \int_{\mathcal{D}_\mathbf{Z}} \frac{1}{(\pi \sigma^2)^{N/2}} e^{ - \frac{1}{\sigma^2} \left\| \mathbf{m} - h e^{j \mathbf{Z}} \right\|^2_2  } p_\mathbf{Z} (\mathbf{z}) d\mathbf{z},
\end{split}
\end{equation}

where $ \mathbf{z} = \left[z_1, \cdots, z_N \right]^T $ denote the integration variables, and $ \mathcal{D}_\mathbf{Z} $ is the domain of the random variables $ \mathbf{Z} $. In addition, $ \mathbb{E}_{\mathbf{Z}} $ denotes statistical expectation with respect to $ \mathbf{Z} $, which has a priori probability density function $ p_{\mathbf{Z}}(\mathbf{z}) $. Assuming that the random phases are independent, then $ p_{\mathbf{Z}}(\mathbf{z}) = \prod_{n = 1}^{N} p_{Z_n}(z_n) $. Thus, (<ref>) can be expressed as

\begin{align} \label{e-B6}
p (\mathbf{m}; h) = \int_{\mathcal{D}_{Z_1}} \cdots \int_{\mathcal{D}_{Z_N}} \frac{1}{(\pi \sigma^2)^{N/2}} e^{ - \frac{1}{\sigma^2} \sum^N_{n = 1}  \left| m_n - h e^{j Z_n} \right|^2 } p_{Z_1}(z_1) \cdots p_{Z_N}(z_N) ~ dz_1 \cdots dz_N.
\end{align}

The CRB of any unbiased estimator $ \widehat{h} $ of the channel $ h $ is given by

\begin{align} \label{e-B7}
\mathsf{CRB} \left( \widehat{h} \right) = \mathbb{E}_{\mathbf{m}} \left[ \frac{\partial }{\partial h} \ln p (\mathbf{m} ; h) \frac{\partial}{\partial h^*} \ln p (\mathbf{m} ; h) \right] ^{-1},
\end{align}

where $ \mathbb{E}_{\mathbf{m}} $ denotes statistical expectation with respect to $ \mathbf{m} $ <cit.>. Nonetheless, the computation of this expression is analytically intractable due to the embedded integration with respect to the random variables $ Z_1, \cdots, Z_N $. As a result, a simpler (but looser) bound called the modified CRB (MCRB) has been derived in <cit.>. Specifically, the MCRB is a lower bound of the CRB, i.e., $ \mathsf{MCRB} \left( \widehat{h} \right)  \leq \mathsf{CRB} \left( \widehat{h} \right) $ is defined as

\begin{align} \label{e-B8}
\mathsf{MCRB} \left( \widehat{h} \right) = \mathbb{E}_{\mathbf{Z}} \left[ \mathbb{E}_{\mathbf{m} \mid \mathbf{Z}} \left[ \frac{\partial}{\partial h} \ln p (\mathbf{m} \mid \mathbf{Z}; h) \frac{\partial}{\partial h^*} \ln p (\mathbf{m} \mid \mathbf{Z}; h) \right] \right]^{-1}.
\end{align}

From (<ref>), we compute the derivatives with respect to $ h $ and $ h^* $,

\begin{align} \label{e-B9}
\frac{\partial}{\partial h} \ln p (\mathbf{m} \mid \mathbf{z}; h) = \frac{1}{\sigma^2} \sum^N_{n = 1} \left( e^{j Z_n} m^{*}_n - h^* \right) = \frac{1}{\sigma^2} \sum^N_{n = 1} w^*_n e^{j Z_n},
\end{align}

\begin{align} \label{e-B10}
\frac{\partial}{\partial h^*} \ln p (\mathbf{m} \mid \mathbf{z}; h) = \frac{1}{\sigma^2} \sum^N_{n = 1} \left( e^{-j Z_n} m_n - h \right) = \frac{1}{\sigma^2} \sum^N_{n = 1} w_n e^{-j Z_n},
\end{align}

Upon replacing (<ref>) and (<ref>) in (<ref>), we obtain that

\begin{equation} \label{e-B11}
\begin{split}
\mathsf{MCRB} \left( \widehat{h} \right)
& = \mathbb{E}_{\mathbf{Z}} \left[ \mathbb{E}_{\mathbf{m} \mid \mathbf{Z}} \left[ \frac{1}{\sigma^2} \sum^N_{n = 1} w^*_n e^{j Z_n} \frac{1}{\sigma^2} \sum^N_{l = 1} w_l e^{-j Z_l} \right] \right]^{-1},  \\
& = \mathbb{E}_{\mathbf{Z}} \left[ \mathbb{E}_{\mathbf{w} \mid \mathbf{Z}} \left[ \frac{1}{\sigma^2} \sum^N_{n = 1} w^*_n e^{j Z_n} \frac{1}{\sigma^2} \sum^N_{l = 1} w_l e^{-j Z_l} \right] \right]^{-1}, \\
& = \mathbb{E}_{\mathbf{Z}} \left[ \mathbb{E}_{\mathbf{w} \mid \mathbf{Z}} \left[ \frac{1}{\sigma^4} \sum^N_{n = 1} \sum^N_{l = 1} w^*_n w_l e^{j Z_n} e^{-j Z_l} \right] \right]^{-1}, \\
& = \mathbb{E}_{\mathbf{Z}} \left[ \mathbb{E}_{\mathbf{w} \mid \mathbf{Z}} \left[ \frac{1}{\sigma^4} \sum^N_{n = 1} \left| w_n \right|^2 + \frac{1}{\sigma^4} \sum^N_{n = 1} \sum^N_{l \neq n} w^*_n w_l e^{j Z_n} e^{-j Z_l} \right] \right]^{-1},  \\
& = \mathbb{E}_{\mathbf{Z}} \left[ \mathbb{E}_{\mathbf{w} \mid \mathbf{Z}} \left[ \frac{1}{\sigma^4} \sum^N_{n = 1} \left| w_n \right|^2 \right] + \mathbb{E}_{\mathbf{w} \mid \mathbf{Z}} \left[ \frac{1}{\sigma^4} \sum^N_{n = 1} \sum^N_{l \neq n} w^*_n w_l e^{j Z_n} e^{-j Z_l} \right] \right]^{-1}, \\
& = \mathbb{E}_{\mathbf{Z}} \left[ \frac{1}{\sigma^4} \sum^N_{n = 1} \mathbb{E}_{w_n \mid \mathbf{Z}} \left[ \left| w_n \right|^2 \right] + \frac{1}{\sigma^4} \sum^N_{n = 1} \sum^N_{l \neq n} \mathbb{E}_{w_n \mid \mathbf{Z}} \left[ w^*_n \right] \mathbb{E}_{w_l \mid \mathbf{Z}} \left[ w_l \right] e^{j Z_n} e^{-j Z_l} \right]^{-1}, \\
& = \mathbb{E}_{\mathbf{Z}} \left[ \frac{N \sigma^2}{\sigma^4} \right]^{-1}.
\end{split}
\end{equation}

In the second step of (<ref>), $ \mathbb{E}_{\mathbf{m} \mid \mathbf{Z}} $ has been changed to $ \mathbb{E}_{\mathbf{w} \mid \mathbf{Z}} $ due to the direct dependence of $ \mathbf{m} $ on $ \mathbf{w} $ (when $ \mathbf{Z} $ is fixed). Note that $ \mathbb{E}_{w_n \mid \mathbf{Z}} \left[ w_n \right] = 0 $ and $ \mathbb{E}_{w_n \mid \mathbf{z}} \left[ \left| w_n \right|^2 \right] = \sigma^2 $ since $ \mathbf{w} \sim \mathcal{CN} \left( 0, \sigma^2 \mathbf{I} \right) $. Thus, $ \sum^N_{n = 1} \mathbb{E}_{w_n \mid \mathbf{z}} \left[ \left| w_n \right|^2 \right] = N \sigma^2 $ and $ \sum^N_{n = 1} \sum^N_{l \neq i} \mathbb{E}_{w_n \mid \mathbf{z}} \left[ w^*_n \right] \mathbb{E}_{w_l \mid \mathbf{z}} \left[ w_l \right] e^{j Z_n} e^{-j Z_l} = 0 $ yielding

\begin{align} \label{e-B12}
\mathsf{MCRB} \left( \widehat{h} \right) = \frac{\sigma^2}{N}.
\end{align}

From (<ref>), we realize that the performance of an optimal estimator $ \hat{h} $ improves with $ N $. Essentially, as more measurements become available, the estimation error decreases. From Section <ref>, the channel estimated by  for a single subcarrier was found to be $ u = \frac{1}{N} \sum^N_{n = 1} m_n $. To evaluate the performance of  we compute its mean square error (MSE). To this purpose, we assume that the random phase rotations are distributed according to a Gaussian probability density function defined as $ p_{Z_n}(z_n) = \frac{1}{\sqrt{2 \pi \xi^2}} e^{-\frac{(z_n - \mu)^2}{2 \xi^2}} $ with mean $ \mu $ and variance $ \xi^2 $. Note that $ \xi^2 $ and $ \mu $ are the same for all the measurements because these are collected for a single subcarrier. Thus,

\begin{equation} \label{e-B13}
\begin{split}
\mathrm{MSE} \left( u \right) & = \mathbb{E} \left[ \left( u - h \right)^* \left( u - h \right) \right], \\
& = \mathbb{E} \left[ \frac{1}{N^2} \sum^N_{n = 1} \sum^N_{i = 1} m^*_n m_i - \frac{h^*}{N} \sum^N_{n = 1} m_n - \frac{h}{N} \sum^N_{n = 1} m^*_i + \left| h \right|^2 \right], \\
& = \underbrace{ \mathbb{E} \left[ \frac{1}{N^2} \sum^N_{n = 1} \sum^N_{i = 1} m^*_n m_i \right] }_{S_1} - \underbrace{ \mathbb{E} \left[ \frac{h^*}{N} \sum^N_{n = 1} m_n \right] }_{S_2} - \underbrace{ \mathbb{E} \left[ \frac{h}{N} \sum^N_{n = 1} m^*_i \right] }_{S^*_2} + \mathbb{E} \left[ \left| h \right|^2 \right],
\end{split}
\end{equation}

Now, by using (<ref>), we expand $ S_1 $

\begin{equation} \label{e-B14}
\begin{split}
S_1 & = \mathbb{E} \left[ \frac{1}{N^2} \sum^N_{n = 1} \sum^N_{i = 1} m^*_n m_i \right], \\
& = \frac{\left| h \right|^2 }{N^2} \mathbb{E} \left[ \sum^N_{n = 1} \sum^N_{i = 1} e^{-j (Z_n - Z_i)} \right]  + \frac{h}{N^2} \mathbb{E} \left[ \sum^N_{n = 1} \sum^N_{i = 1} w^*_n e^{j Z_i} \right] +
\frac{h^*}{N^2} \mathbb{E} \left[ \sum^N_{n = 1} \sum^N_{i = 1} w_i e^{-j Z_n} \right] +
\frac{1}{N^2} \mathbb{E} \left[ \sum^N_{n = 1} \sum^N_{i = 1} w^*_n w_i \right] \\
& = \frac{\left| h \right|^2 }{N^2} \mathbb{E} \left[ \sum^N_{n = 1} \sum^N_{i = 1} e^{-j (Z_n - Z_i)} \right] +
\frac{h}{N^2} \underbrace{ \sum^N_{n = 1} \sum^N_{i = 1} \mathbb{E} \left[ w^*_n \right] \mathbb{E} \left[ e^{j Z_i} \right] }_{0} + \frac{h^*}{N^2} \underbrace{ \sum^N_{n = 1} \sum^N_{i = 1} \mathbb{E} \left[ w_i \right] \mathbb{E} \left[ e^{-j Z_n} \right] }_{0} + \frac{1}{N^2} \underbrace{ \mathbb{E} \left[ \sum^N_{n = 1} \sum^N_{i = 1} w^*_n w_i \right] }_{N \sigma^2}, \\
& = \frac{\left| h \right|^2 }{N^2} \mathbb{E} \left[ \sum^N_{n = 1} \sum^N_{i = 1} e^{-j (Z_n - Z_i)} \right] + \frac{\sigma^2}{N}
\end{split}
\end{equation}

The sum of complex exponentials in (<ref>) can be equivalently expressed as,

\begin{equation} \label{e-B15}
\begin{split}
\sum^N_{n = 1} \sum^N_{i = 1} e^{-j (Z_n - Z_i)} = & N + \sum^N_{n = 1} \sum^N_{i \neq n } e^{-j (Z_n - Z_i)} \\
= & N + 2 \sum^{N-1}_{i = 1} \sum^N_{n = i+1 } \cos (Z_i - Z_n) \\
= & N + 2 \sum^{\frac{N(N-1)}{2}}_{l = 1} \cos (X_l) \\
= & N + N(N-1) \cos (X).
\end{split}
\end{equation}

In (<ref>), $ X = Z_i - Z_n $, $ \forall i,n $ denotes the difference of two Gaussian random variables. The resulting random variable $ X $ is also Gaussian, which can be obtained by means of the convolution theorem. Specifically, $ X $ has mean zero and twice the variance of $ Z_i $, i.e., the probability density function of $ X $ is given by $ p_X(x) = \frac{1}{\sqrt{4 \pi \xi^2}} e^{-\frac{x^2}{4 \xi^2}} $. Replacing (<ref>) in (<ref>), $ S_1 $ can be recast as

\begin{equation} \label{e-B16}
\begin{split}
S_1 & = \frac{\left| h \right|^2 }{N^2} \mathbb{E} \left[ \sum^N_{n = 1} \sum^N_{i = 1} e^{-j (Z_n - Z_i)} \right] + \frac{\sigma^2}{N}, \\
& = \frac{\left| h \right|^2 }{N^2} \left( N + N(N-1) \mathbb{E} \left[ \cos (X)  \right] \right) + \frac{\sigma^2}{N}, \\
& = \frac{\left| h \right|^2 }{N} + \frac{\left| h \right|^2 (N-1) }{N} \mathbb{E} \left[ \cos (X) \right] + \frac{\sigma^2}{N}, \\
& = \frac{\left| h \right|^2 }{N} + \frac{\left| h \right|^2 (N-1) }{N} \int_{-\infty}^{\infty} \cos (x) \frac{1}{\sqrt{4 \pi \xi^2}} e^{\frac{-x^2}{4 \xi^2}} dx + \frac{\sigma^2}{N}, \\
& = \frac{\left| h \right|^2 }{N} + \frac{\left| h \right|^2 (N-1) }{N} e^{-\xi^2} + \frac{\sigma^2}{N},
\end{split}
\end{equation}

where $ e^{-\xi^2} = \int_{-\infty}^{\infty} \cos (x) \frac{1}{\sqrt{4 \pi \xi^2}} e^{\frac{-x^2}{4 \xi^2}} dx $. Besides, the term $ S_2 $ collapses to

\begin{equation} \label{e-B17}
\begin{split}
S_2 & = \mathbb{E} \left[ \frac{h^*}{N} \sum^N_{n = 1} m_n \right] \\
& = \frac{\left| h \right|^2 }{N}  \cdot \mathbb{E} \left[ \sum^N_{n = 1} e^{j Z_n} \right] + \frac{h^*}{N} \mathbb{E} \left[ \sum^N_{n = 1} w_n \right] \\
& = \left| h \right|^2 \mathbb{E} \left[ e^{j Z_n} \right] + \underbrace{ \frac{h^*}{N} \mathbb{E} \left[ \sum^N_{n = 1} w_n \right] }_{0} \\
& = \left| h \right|^2 \int_{-\infty}^{\infty} e^{j Z_n} \frac{1}{\sqrt{2 \pi \xi^2}} e^{\frac{-(Z_n - \mu)^2}{2 \xi^2}} dZ_n \\
& = \left| h \right|^2 e^{-\xi^2/2} e^{j \mu}.
\end{split}
\end{equation}

Collecting the results in (<ref>) and (<ref>), the MSE collapses to

\begin{equation} \label{e-B18}
\begin{split}
\mathrm{MSE} \left( u \right) & = \frac{\left| h \right|^2 }{N} + \left| h \right|^2 e^{-\xi^2} - \frac{\left| h \right|^2 e^{-\xi^2}}{N} + \frac{\sigma^2}{N} - \left| h \right|^2 e^{-\xi^2/2} e^{j \mu}  - \left| h \right|^2 e^{-\xi^2/2} e^{-j \mu}  + \left| h \right|^2, \\
& = \left| h \right|^2 + \left| h \right|^2 e^{-\xi^2} - 2 \left| h \right|^2 \cos(\mu) e^{-\xi^2/2} + \frac{\left| h \right|^2 }{N} - \frac{\left| h \right|^2 e^{-\xi^2}}{N} + \frac{\sigma^2}{N}.
\end{split}
\end{equation}

By definition, the MSE of any estimator consists of the bias and the variance as shown in

\begin{align} \label{e-B19}
\mathrm{MSE} \left( u \right) = \mathrm{bias} \left( u \right)^2  + \mathrm{var} \left( u \right).
\end{align}

The bias of the estimator is computed as

\begin{equation} \label{e-B20}
\begin{split}
\mathrm{bias} \left( u \right) & = \mathbb{E} \left[ u - h \right], \\
& = \mathbb{E} \left[ u \right] - h,  \\
& = h \mathbb{E} \left[ e^{j Z} \right] - h,  \\
& = h \int_{-\infty}^{\infty} e^{j Z} \frac{1}{\sqrt{2 \pi \xi^2}} e^{-\frac{(z - \mu)^2}{2 \xi^2}} dz - h,  \\
& = h e^{-\xi^2/2} e^{j \mu} - h.
\end{split}
\end{equation}

Thus, the squared bias is

\begin{equation} \label{e-B21}
\begin{split}
\mathrm{bias} \left( u \right)^2 & = (h e^{-\xi^2/2} e^{j \mu} - h)^* (h e^{-\xi^2/2} e^{j \mu} - h), \\
& = \left| h \right|^2 + \left| h \right|^2 e^{-\xi^2} - 2 \left| h \right|^2 \cos(\mu) e^{-\xi^2/2}.
\end{split}
\end{equation}

By comparing (<ref>), (<ref>) and (<ref>), we can extract the variance of the estimator. Therefore,

\begin{align} \label{e-B22}
\mathrm{var} \left(  u \right) = \frac{ \left|h \right|^2 }{N} - \frac{ \left|h \right|^2 }{N} e^{- \xi^2} + \frac{\sigma^2}{N}.
\end{align}

xlabel = $ \xi^2 [\text{deg}^2] $,
ylabel = $ \mathrm{bias} \left( u \right)^2 / \left| h \right|^2  $,
xtick = 0.1, 0.4, 0.7, 1.0,
xticklabels = 5, 20, 40, 60,
height = 5.4cm,
width = 9cm,
legend columns = 1,
legend pos = north east,
legend style = at = (1.01,0.0), anchor = south west, font = , fill = white,  font=77, /tikz/every even column/.append style=column sep=0.5cm, legend style=row sep=1pt, inner sep = 2pt, align = left,
legend cell align=left,

[black,thick] expression[domain=0:1] 1 + e^(-x) - 2*e^(-x/2);

[color = cyan, semithick, densely dashed] expression[domain=0:1] 1 + e^(-x) - 2*cos(1)*e^(-x/2);

[color = pink, semithick, densely dashed] expression[domain=0:1] 1 + e^(-x) - 2*cos(2)*e^(-x/2);

[color = green, semithick, densely dashed] expression[domain=0:1] 1 + e^(-x) - 2*cos(5)*e^(-x/2);

[color = orange, semithick, densely dashed] expression[domain=0:1] 1 + e^(-x) - 2*cos(10)*e^(-x/2);

[color = blue, semithick, densely dashed] expression[domain=0:1] 1 + e^(-x) - 2*cos(20)*e^(-x/2);

[color = red, semithick, densely dashed] expression[domain=0:1] 1 + e^(-x) - 2*cos(45)*e^(-x/2);

[color = brown, semithick, densely dashed] expression[domain=0:1] 1 + e^(-x) - 2*cos(90)*e^(-x/2);

[color = gray, semithick, densely dashed] expression[domain=0:1] 1 + e^(-x) - 2*cos(180)*e^(-x/2);

Legitimate user, Attacker | $ \mu = 1^{\circ} $, Attacker | $ \mu = 2^{\circ} $, Attacker | $ \mu = 5^{\circ} $, Attacker | $ \mu = 10^{\circ} $, Attacker | $ \mu = 20^{\circ} $, Attacker | $ \mu = 45^{\circ} $, Attacker | $ \mu = 90^{\circ} $, Attacker | $ \mu = 180^{\circ} $;

Comparison of normalized biases between legitimate users and attackers considering various configurations of $\mu$ and $ \xi^2 $. In the case of attackers, the bias increases since the additional shift $ \mu $ cannot be removed. Specifically, this occurs due to the impossibility to attackers of generating the sequence of random numbers that renders $ \mu $, which can only obtained by legitimate users.

Upon comparing (<ref>) and (<ref>), we note that a large variance $ \xi^2 $ ($ \xi^2 $ in radians) of the random variables $ Z_n $ leads to a high estimation error according to (<ref>). In such a case, $ \mathrm{var} \left(  u \right) \approx \frac{ \left|h \right|^2 }{N} + \frac{\sigma^2}{N} $. However, for small values of $ \xi^2 $, the variance collapses to $ \mathrm{var} \left(  u \right) \approx \frac{\sigma^2}{N} $, thus showing the equivalence between (<ref>) and (<ref>). While this observation demonstrates that the estimation error of  is near-optimal in the variance sense, we also need to consider the bias in (<ref>), which is nonzero. Ideally, the estimator needs to be unbiased, i.e., $ \mathrm{bias} \left( u \right)^2 = 0 $. As explained  in Section <ref>, a legitimate user is aware of the synchronization index and key, and can therefore generate the same sequence of random numbers that yield $ \mu $ (i.e., shifts of the probability density functions). As a result, a legitimate user can remove the additional shift, thus making $ \mu = 0 $. In contrast, for an attacker, $ \mu \neq 0 $. The bias for legitimate users and attackers are respectively defined as

\begin{equation} \label{e-B23}
\begin{split}
\mathrm{bias}_l \left( u \right)^2 & = \left| h \right|^2 + \left| h \right|^2 e^{-\xi^2} - 2 \left| h \right|^2 e^{-\xi^2/2},
\end{split}
\end{equation}

\begin{equation} \label{e-B24}
\begin{split}
\mathrm{bias}_a \left( u \right)^2 & = \left| h \right|^2 + \left| h \right|^2 e^{-\xi^2} - 2 \left| h \right|^2 \cos(\mu) e^{-\xi^2/2}, ~ \mu \neq 0,
\end{split}
\end{equation}

showing that $ \mathrm{bias}_l \left( u \right)^2 \leq \mathrm{bias}_a \left( u \right)^2 $.

To illustrate the difference between (<ref>) and (<ref>), we show in Fig. <ref> the biases for several configurations of $ \mu $ and $ \xi^2 $. We observe that for only small $ \mu = \left\lbrace 1^\circ, 5^\circ \right\rbrace $ the biases of the attacker and the legitimate users are similar. However, for sufficiently large $ \mu $ the difference between the two biases becomes noticeable. In our approach, , $ \mu $ is not fixed but is instead randomly generated for every subcarrier using the randomization index and the key. Therefore, for potential attackers—not aware of this information—the bias for each subcarrier varies within the range of values shown in Fig. <ref>, hindering accurate CSI acquisition. Further, for small $ \xi^2 $ we observe that $ \mathrm{bias}_l \left( u \right)^2 \approx 0 $, thus indicating that  can be seen as an unbiased estimator in the case of legitimate users when the variance of the phase rotations is low. To clarify this aspect, in Fig. <ref> we show the MCRB bound and the variance of the estimator  when  is used to conceal the CSI. In Fig. <ref> we have neglected the effect of bias and assumed that $ \left| h \right|^2 = \sigma^2 = 1 $. We realize that even for large values of $ \xi^2 $,  is capable of performance similarly to the MCRB bound in terms of its variance. In Fig. <ref>, we consider the overall effect of bias and variance in channel estimation for both legitimate users and attackers. We observe that for legitimate users,  performs near-optimally when $ \xi^2 $ is relatively small (i.e., $ \xi^2 = 5 $) whereas the error increases for larger $ \xi^2 $. However, as demonstrated in Section <ref>, even a small value of $ \xi^2 $ is effective in hindering the CSI acquisition by attackers. Thus, $ \xi^2 = 5 $ can be used to successfully protect the CSI and the radiometric fingerprint while assuring near-optimality. For potential attackers, the errors between $ 10 $ and $ 100 $ times higher for the shown setting.

xlabel = Number of samples ($ N $),
ylabel = MSE (variance),
legend columns = 5,
legend pos = north east,
legend style = at = (-0.19,1.01), anchor = south west, font = , fill = white,  font=77, /tikz/every even column/.append style=column sep=0.27cm, legend style=row sep=1pt, inner sep = 2pt, align = left,
legend cell align=left,

[black,semithick, dashed] expression[domain=1:100] 1/x;

[color = v01, semithick] expression[domain=1:100] 1/x -e^(-0.1)/x + 1/x;

[color = v04, semithick] expression[domain=1:100] 1/x - e^(-0.4)/x + 1/x;

[color = v07, semithick] expression[domain=1:100] 1/x - e^(-0.7)/x + 1/x;

[color = v10, semithick] expression[domain=1:100] 1/x - e^(-1.0)/x + 1/x;

$ \mathrm{MCRB} $, $ \Tool{} | \xi^2 = 5 $, $ \Tool{} | \xi^2 = 20 $, $ \Tool{} | \xi^2 = 40 $, $ \Tool{} | \xi^2 = 60 $;

xlabel = Number of samples ($ N $),
ylabel = MSE (variance + bias),

[black,semithick, dashed] expression[domain=1:100] 1/x;

[color = v01, semithick] expression[domain=1:100] 1/x -e^(-0.1)/x + 1/x + 1 + e^(-0.1) - 2*e^(-0.1/2);

[color = v04, semithick] expression[domain=1:100] 1/x - e^(-0.4)/x + 1/x + 1 + e^(-0.4) - 2*e^(-0.4/2);

[color = v07, semithick] expression[domain=1:100] 1/x - e^(-0.7)/x + 1/x + 1 + e^(-0.7) - 2*e^(-0.7/2);

[color = v10, semithick] expression[domain=1:100] 1/x - e^(-1.0)/x + 1/x + 1 + e^(-1.0) - 2*e^(-1.0/2);

[color = v01, semithick] expression[domain=1:100] 1/x -e^(-0.1)/x + 1/x + 1 + e^(-0.1) - 2*cos(90)*e^(-0.1/2);

[color = v04, semithick] expression[domain=1:100] 1/x - e^(-0.4)/x + 1/x + 1 + e^(-0.4) - 2*cos(90)*e^(-0.4/2);

[color = v07, semithick] expression[domain=1:100] 1/x - e^(-0.7)/x + 1/x + 1 + e^(-0.7) - 2*cos(90)*e^(-0.7/2);

[color = v10, semithick] expression[domain=1:100] 1/x - e^(-1.0)/x + 1/x + 1 + e^(-1.0) - 2*cos(90)*e^(-1.0/2);

(30, 1.9) ellipse(0.15cm and 0.3cm);
[text width=1.2cm, anchor=west, right] at (22, 0.7) attacker;

(60, 0.064) ellipse(0.15cm and 0.64cm);
[text width=1.2cm, anchor=west] at (48, 0.40) legitimate;
[text width=1.2cm, anchor=west] at (53, 0.27) user;

Comparison of MCRB and  when using  as a tool to conceal the CSI from potential attackers.

As complementary discernment, we show non-tight MCRBs bounds for the channel magnitude, channel phase, and variance of the disturbance that reveal relations that can be used to guide the design of alternative estimators.

\begin{align} \label{e-B25}
\mathsf{MCRB} \left( \widehat{\left| h \right|} \right) = \frac{\sigma^2}{2 N}
\end{align}

\begin{align} \label{e-B26}
\mathsf{MCRB} \left( \widehat{\phi} \right) = \frac{\sigma^2}{2 N \left| h \right|^2} = \frac{ \mathsf{MCRB} \left( \widehat{\left| h \right|} \right) }{ \left| h \right|^2 }
\end{align}

\begin{align} \label{e-B27}
\mathsf{MCRB} \left( \widehat{\mathbf{z}} \right) = \frac{1}{\frac{2 N \left| h \right|^2}{\sigma^2} + \frac{N}{\xi^2}} = \frac{1}{\mathsf{MCRB} \left( \widehat{\phi} \right)^{-1} + \frac{N}{\xi^2}}
\end{align}

§ EXPERIMENTAL RESULTS FOR 802.11A

We analyze the performance of naive randomization in 802.11a[The main difference between these two technologies is the number of subcarriers, which is $ 52 $ and $ 56 $ for 802.11a and 802.11ac, respectively.] and show the results in fig:zero_mean_mae_80211a.
The results suggest that naive randomization performs similarly in 802.11a and 802.11ac, i.e., through  the  MAE error diminishes with larger $ N $, which allows an adversary to restore the original fingerprint.

The results of  over 802.11a are shown in fig:x_mean_mae_80211a, which are reminiscent of the behavior observed with 802.11ac in fig:non_zero_mean_mae. In particular, the MAE is 10-fold the error achieved with naive randomization. This experiment corroborates that  is not only feasible in 802.11ac but also in other technologies with a similar underlying structure.

§ NI 802.11 APPLICATION FRAMEWORK

The implementation of the NI 802.11 AFW is separated into a host and an FPGA module, as depicted in fig:afw_overview.
The host module of the NI 802.11 AFW mainly implements middle MAC layer functionalities as well as a MAC high abstraction layer.
The latter allows third party 802.11 higher MAC applications, such as the ns-3 network simulator, to connect to the stack.
The MAC high abstraction layer is connected to MAC middle layer via UDP, which is responsible for duplicate detection in RX and synchronization index assignment in TX direction.

Note that the higher MAC abstraction layer does not implement association or authentication procedures, so the NI 802.11 AFW cannot complete the connection setup to COTS hardware.
To still allow data streams for demo  and measurement purposes between two instances of the 802.11 AFW, simplistic data sinks and sources (random data / UDP) are available.

The FPGA module includes the implementation of the lower MAC layer as well as the whole physical layer.
Even though both layers are running on the FPGA, they are executed in different clock domains, as the timing requirements are different.
This results in clock rates of 100 MHz (10 nanoseconds) and 250 MHz (4 nanoseconds) for MAC and physical layer, respectively.

The main building blocks of the physical layer, as implemented on the FPGA, are depicted in fig:fpga_block.
In TX direction, the lower MAC layer passes the digital data as bits through the TX PHY SAP to the physical layer.
The first block (PSDU Discard) removes the PHY service data unit (PSDU) and verifies the consistency of the packet before passing it to the TX Bit Processing block.
This following block takes care of serialization, scrambling, convolutional encoding, puncturing, and interleaving.
The subsequent TX IQ Processing block modulates the data and creates the OFDM symbols, including all training fields.
While the STF is pre-calculated in time-domain, all other training fields, such as the LTFs are modulated in frequency-domain.
After that, the Inverse Fast Fourier Transform (IFFT) transforms the data form the frequency domain into the time-domain.
The time domain samples are written to the TX to RF FIFO in the last block (TX Data Sink).
The final steps, consisting of up-conversion to carrier frequency and sending out the up-converted samples over the air, are left out of fig:fpga_block for brevity.

The PHY code in RX direction involves more steps to accurately and correctly identify and retrieve a packet.
The RX Signal Filter reads the already down-converted samples in the baseband and filters for 40 or 20 MHz channels.
Upon that, the synchronization detects the packet start using the Schmidl and Cox algorithm <cit.>, which also estimates and compensates the CFO.