The Phase Noise and Clock Synchronous Carrier Frequency Offset based RF Fingerprinting for the Fake Base Station Detection

This paper presents very promising radio frequency (RF) fingerprinting techniques for the terminal-based detection of fake base station (FBS) in a wireless cellular network. The proposed schemes are based on identifying the analog hardware impairments of the transmitter. In this regard, phase noise analysis and its measured signatures reveal that low to medium end software defined radio (SDR) acting as FBS can certainly be detected if the detecting terminal’s own phase noise is at least 10-dB better than the transmitter. However, for medium to high end FBS, a computationally efficient network synchronized carrier frequency offset (CFO) approach has been proposed and the measurement results confirm that the regular base stations (RBS) that are clock synchronized show identical CFO values whereas, the FBS show large and random offset values. Furthermore, the CFO stability (Frequency offset vs. time) signatures illustrate that an FBS running by its own lazy clock show a large instability in the frequency offset values and even in case of a precision clock, fluctuations vanish though the stabilized offset is still large enough for a user terminal to distinguish the FBS from the RBS.