PaperlayerView exact revision on arXiv

Source-linked AI summary

Physical-Layer Fingerprint-Space Capacity Analysis for 100BASE-TX Devices in IIoT

Chenming Zhang, Aiqun Hu

arXiv:2608.27164v1cs.CReess.SP

TL;DR

Reliable authentication is needed for expanding IIoT networks, while the distinguishable capacity of 100BASE-TX physical-layer fingerprints remains insufficiently explored. The paper introduces NAIM to model steady-state and transition waveform differences under waveform and observation constraints. It derives approximately 2.96×10^10 distinguishable states and evaluates empirical capacity and identification using 48 NICs under two cable conditions.

  • Problem

    The distinguishable space and capacity boundary supported by 100BASE-TX physical-layer fingerprints remain largely unexplored, despite the need to prevent device impersonation in IIoT networks.

  • Method

    The paper develops NAIM to represent steady-state level and impulse-response waveform variations, then derives capacity under waveform requirements, observation resolution, and target BER.

  • Results

    Approximately 2.96×10^10 distinguishable states are derived for 100BASE-TX terminals, with experiments using 48 NICs under two cable conditions.

  • Takeaways & Limitations

    Under the 5-m cable condition, empirical capacity and closed-set identification consistently rank the three NIC models, supporting pre-deployment assessment and NIC-model selection.

Abstract

from arXiv · show

Industrial Internet of Things (IIoT) networks widely adopt Ethernet technologies, such as 100BASE-TX, for industrial communications. As industrial networks continue to scale, reliable device authentication becomes increasingly important for preventing device impersonation and unauthorized access. Physical-layer fingerprinting (PLF) exploits device-dependent fingerprint features in transmitted signals and provides a hardware-based approach for terminal authentication. However, the distinguishable space supported by 100BASE-TX physical-layer fingerprints and its capacity boundary remain largely unexplored. To analyze the capacity of physical-layer fingerprints, this paper proposes a nonlinear and impulse-response model (NAIM) that characterizes device-dependent waveform differences in 100BASE-TX transmitted waveforms. The nonlinear component captures steady-state level deviations, while the impulse-response component describes the transition response during level transitions. The 100BASE-TX transmitter waveform requirements, the observation resolution determined by noise and analog-to-digital conversion (ADC) quantization, and the target bit-error ratio (BER) constrain the admissible fingerprint space. Under the NAIM model, the fingerprint-space capacity of 100BASE-TX terminals is derived as approximately $2.96\times10^{10}$ distinguishable states. Experiments on signals collected from 48 NICs under two cable conditions estimate a Gaussian-equivalent empirical capacity from the measured inter-device and within-device variations. Under the 5-m cable condition, empirical capacity and closed-set identification consistently rank the three NIC models, and a larger empirical capacity yields higher identification accuracy. These results demonstrate that the proposed capacity analysis provides a pre-deployment assessment for physical-layer fingerprinting in IIoT.

I. INTRODUCTION

100BASE-TX physical-layer fingerprints offer hardware-based authentication, but the distinguishable fingerprint-space size remains insufficiently quantified. This paper develops a model-based framework to analyze that capacity from device-dependent waveform variation and practical observation constraints.

  • 100BASE-TX is widely used in IIoT networks because of its mature protocol ecosystem and relatively low deployment cost.
  • Credential-based access control cannot reliably verify that a credential originates from the claimed physical device, leaving cloned or leaked credentials vulnerable to impersonation.
  • Physical-layer fingerprinting complements software credentials by exploiting device-dependent variations embedded in transmitted signals.
  • Existing wired studies mainly evaluate identification on fixed device sets, while the quantitative size of the distinguishable 100BASE-TX fingerprint space has received limited attention.
  • Experiments characterize practical separability using Gaussian-equivalent empirical capacity and cross-day closed-set identification on measured NICs.
  • The proposed framework models device-dependent waveform variation with NAIM and evaluates capacity using waveform constraints, observation resolution, and jointly feasible parameter combinations.

B. Authentication Evaluation and Fingerprint-Space Capacity

The paper traces 100BASE-TX fingerprint variation to the device-dependent analog transmit path after standardized digital encoding. NAIM separates steady-state level deviations from transition dynamics to represent these differences in an interpretable waveform model.

  • 100BASE-TX Transmit Chain and Waveform Differences: 100BASE-TX digital processing produces a three-level MLT-3 sequence, which then enters a device-dependent analog path at the active output interface.
  • 100BASE-TX Transmit Chain and Waveform Differences: Compliant digital encoding follows common symbol rules, so device-dependent waveform differences arise primarily from analog-path effects on levels and transition behavior.
  • MLT-3 Steady-State Level Mapping: Measured NICs show asymmetric positive and negative plateaus and differing post-peak FIR settling behavior, motivating NAIM’s two components.
  • MLT-3 Steady-State Level Mapping: NAIM uses a memoryless nonlinear mapping Γ(·) for steady-state levels and an impulse response h[k] for finite rise, fall, and settling dynamics.
  • MLT-3 Steady-State Level Mapping: The three-level MLT-3 alphabet reduces the steady-state mapping to two effective parameters representing differential amplitude and midpoint offset.

C. Impulse Response and Waveform Parameter Vector

The impulse-response component represents post-transition dynamics with a shared fixed basis and device-dependent expansion coefficients. Together with the steady-state parameters, these coefficients form the finite-dimensional NAIM fingerprint vector.

  • Impulse Response: The impulse response is expanded over fixed damped-sinusoidal candidates spanning the 1–200 MHz analysis band.
  • Impulse Response: Each basis waveform is normalized and band-limited, while device dependence enters through expansion coefficients rather than the shared basis.
  • Impulse Response: The modeled response combines a fixed baseline response with weighted device-dependent basis contributions.
  • Impulse Response: FIR responses are estimated by ridge regression and projected onto the fixed basis to obtain device-dependent coefficients reflecting the joint observation chain.
  • Waveform Parameter Vector: The NAIM parameter vector collects two steady-state parameters and the impulse-response coefficients while excluding the fixed baseline.

IV. FINGERPRINT-SPACE CAPACITY ESTIMATION

Fingerprint-space capacity is computed by varying NAIM parameters and counting only waveform states that remain jointly feasible and observable under the model’s coordinate construction.

  • Fingerprint-Space Capacity Estimation: NAIM parameters are varied to generate output waveforms, while transmitter requirements constrain parameter ranges and noise and ADC resolution constrain observable differences.
  • Fingerprint-Space Capacity Estimation: Capacity counts jointly feasible parameter combinations because multiple parameters can affect the same output waveform.
  • Fingerprint Coordinate Construction: The parameter vector contains steady-state level parameters and band-pass coefficients, whose shared variation must not be counted twice.
  • Fingerprint Coordinate Construction: The coordinate construction standardizes level and band-pass groups, regresses band-pass coordinates on level coordinates, and retains residual impulse-response coordinates.
  • Fingerprint Coordinate Construction: The resulting joint coordinate is used to evaluate directional resolution and feasible parameter ranges.

B. Active Output Interface and Waveform Requirements

The analysis maps NAIM parameters to waveform outputs at the AOI and constrains admissible fingerprints using standard waveform requirements, observation resolution, and BER-related checks.

  • Parameter mapping: The NAIM parameter vector is converted to physical units before evaluating the noiseless waveform against AOI requirements.Only the two steady-state components are scaled; impulse-response coefficients remain unchanged.
  • Waveform requirements: The capacity calculation uses four time-domain requirement groups: peak output, transient overshoot and settling, amplitude symmetry, and rise/fall timing.The specified bounds include 0.950–1.050 V peak output, 5% overshoot, 8 ns settling, 0.98–1.02 amplitude ratio, and 3–5 ns rise/fall time.
  • Observation resolution: Observation resolution is modeled through additive noise and ADC quantization, which determine the minimum waveform change counted as distinguishable.The directional step size depends on projected noise and quantization variation.
  • Directional analysis: The normalized Jacobian uses SVD to identify orthogonal parameter directions and rank them by waveform sensitivity relative to observation noise.Each singular value measures the normalized waveform change produced by a unit perturbation along its corresponding direction.
  • BER check: A feasible waveform must also retain the target decision margin under the specified timing and noise assumptions.The Gaussian tail function and adopted BASE-T BER objective define the auxiliary threshold check.

D. Jointly Feasible States and Fingerprint-Space Capacity

Fingerprint-space capacity counts parameter combinations that satisfy waveform constraints jointly, rather than multiplying independent directional ranges, with joint feasibility estimated by RQMC.

  • Joint feasibility: Independent directional state counts cannot simply be multiplied because simultaneous parameter variations interact through the common output waveform.Capacity therefore combines directional ranges with the fraction of combinations that remain feasible.
  • Joint feasibility: An oblique boundary shows that the allowable range along one parameter direction depends on variation in another direction.In the illustrated cross-section, the main boundary corresponds to waveforms remaining more than 1% from steady state 8 ns after transition onset.
  • Joint feasibility: One-dimensional feasible intervals are combined into a Cartesian product, then filtered to retain only jointly feasible waveform states.The feasible subset is evaluated after scaling by the normalized scan radius.
  • Capacity estimation: The joint feasibility rate is estimated with randomized quasi-Monte Carlo sampling using scrambled Sobol sequences.Each scramble maps samples into the directional product region and tests the resulting NAIM waveforms against the requirements.
  • Capacity result: Including residual impulse-response coordinates increases the steady-state-only count by approximately 78×.The reported capacity combines waveform requirements, observation resolution, and joint feasibility.

V. EXPERIMENTAL SETUP AND EVALUATION

The evaluation uses 48 NICs from three models under 0.5-m and 5-m cable conditions, with differential waveforms collected across multiple days for reconstruction, capacity estimation, and identification.

  • Dataset: The dataset contains 48 NICs from AX88772, CH9151, and RTL8152B, with 16 devices per model.Measurements span a four-day campaign and include both cable conditions.
  • Acquisition: Signals were acquired through either a 0.5-m or 5-m Cat6 UTP cable and formed as the differential waveform CH1−CH2.The observation includes the NIC, cable, terminal load, and measurement chain.
  • Evaluation protocol: Model reconstruction and empirical-capacity estimation use all available measurement days for each cable condition.Repeated captures within a day and cross-day observations support variation analysis.
  • Evaluation protocol: Closed-set identification uses 5-m measurements in a leave-one-day-out evaluation.The held-out day evaluates variation across measurement days.
  • Settings: The experimental and numerical settings are summarized in Table II.The setup covers the measurement campaign and the numerical parameters used for fingerprint analysis.

B. Impulse-Response Extraction and Model Configuration

The paper configures NAIM by extracting normalized impulse responses and representing them with a selected basis, then evaluates fingerprint capacity in a constrained coordinate space. Empirical capacity compares inter-device spread with repeated-measurement variation.

  • Impulse-Response Extraction: An 81-tap FIR response is estimated by ridge regression, mean-removed, normalized to unit ℓ2 norm, and restricted to a band excluding DC and slow drift.The ridge parameter is λridge = 10^-6 max[tr(X^TX)/81, 1].
  • Model Configuration: M = 44 impulse-response basis terms are selected by coefficient ranking, correlation pruning at 0.995, and a one-standard-error NMSE rule.The basis is ranked using ridge-projection coefficients against a band-limited reference and the grand-mean response.
  • Capacity Definitions: Fingerprint-space capacity quantifies distinguishable waveform states allowed by NAIM under waveform requirements and observation resolution.Empirical capacity instead measures inter-device spread relative to repeated-measurement variation.
  • Fingerprint-Space Capacity: The capacity calculation varies NAIM coordinates, converts steady-state parameters using a reference amplitude, and checks waveform feasibility, observation resolution, and decision margin.The reference amplitude is A0 = 1.302 × 10^4 counts, giving g = 7.678 × 10^-5 V/count for V0 = 1 V.
  • Fingerprint-Space Capacity: The capacity estimate uses the first d = 16 active SVD directions, with confidence intervals computed across independently scrambled Sobol sets.
  • Empirical Capacity: Gaussian-equivalent empirical capacity uses device-centroid covariance and pooled within-device covariance in the conditioned coordinate space.The within-device covariance includes variation across the three measurement days and is OAS-shrunk.

D. Cross-Day Closed-Set Identification

Cross-day identification uses an OAS–Mahalanobis nearest-centroid classifier with leave-one-day-out testing at 5 m. The reconstruction results show that the 44-term NAIM captures the main temporal and spectral structure under both cable conditions.

  • Cross-Day Identification: An OAS–Mahalanobis nearest-centroid classifier evaluates whether NAIM coordinates preserve device-level separability across days.
  • Cross-Day Identification: Closed-set identification uses leave-one-day-out testing at 5 m, registering on two days and testing on the remaining day in each fold.
  • Cross-Day Identification: Each fold estimates device centroids and OAS-shrunk within-class covariance from the two registration days before classification.For each device, training waveforms are averaged to obtain its centroid.
  • Reconstruction Results: The median NMSEs are 0.023 for 0.5 m and 0.033 for 5 m, while median in-band energies are 72.2% and 67.6%, respectively.The upper-quartile NMSE does not exceed 0.047 under either cable condition.
  • Reconstruction Results: The 44 impulse-response parameters capture the main temporal and spectral structure of the estimated in-band response under both cable conditions.Reconstructions follow major time-domain peaks and decay, as well as spectral peaks and notches over 1–200 MHz.

B. Fingerprint-Space Capacity and Industrial-Scale Context

Within the retained 16-direction subspace, jointly feasible waveform variations yield approximately 2.96 × 10^10 distinguishable states at ρ = 1, while empirical capacity characterizes separability in measured NICs under specific cable conditions.

  • Model-based capacity: 2.96 × 10^10 distinguishable states are estimated at ρ = 1 and kσ = 1 within the retained 16-direction subspace.The first 16 SVD directions account for 99.991% of the total squared singular-value sum.
  • Model-based capacity: 1.86 × 10^13 independent-direction states reduce to 2.96 × 10^10 jointly feasible states, a factor-of-628 reduction from directional coupling.Joint variation through the common output waveform can violate waveform requirements even when each direction is individually admissible.
  • Model-based capacity: [2.54 × 10^10, 3.37 × 10^10] is the 95% confidence interval from eight RQMC estimates at the reference setting.The interval preserves the 10^10-state scale.
  • Empirical capacity: 1.63 × 10^3 and 2.44 × 10^5 distinguishable devices are the Gaussian-equivalent empirical capacities at 0.5 m and 5 m, respectively.These estimates characterize inter-device spread relative to repeated-measurement variation in the measured device set.
  • Measurement sensitivity: Omitting the third 0.5-m acquisition increases empirical capacity from approximately 1.63 × 10^3 to 2.05 × 10^5 distinguishable devices.The third acquisition followed cable reconnection and used a different physical cable arrangement.

D. Closed-Set Identification and NIC-Model Comparison

Under the 5-m cable condition, closed-set identification and empirical capacity consistently rank the three NIC models. The results connect larger empirical capacity with stronger device separability and support pre-deployment NIC-model assessment.

  • Closed-Set Identification: 90.97% cross-day Top-1 accuracy is achieved under the 5-m observation condition.Fold-wise accuracies are 89.58%, 91.67%, and 91.67%.
  • NIC-Model Comparison: The three NIC models largely occupy different regions in the first two principal components.The projection explains about 85.9% of the variance, and RTL8152B contains two sub-clusters.
  • NIC-Model Comparison: RTL8152B, AX88772, and CH9151 have identical rankings in empirical capacity and cross-day Top-1 accuracy.This agreement links empirical capacity with device separability preserved across days.
  • Implications: The proposed capacity analysis provides a pre-deployment assessment for physical-layer fingerprinting and can guide NIC-model selection.Experiments on 48 NICs under the 5-m cable condition support this application.
  • Limitations and Future Work: Future work will examine temperature variation, longer-term drift, cable-length variation, and larger device populations.The stated extension scope goes beyond the evaluated 48 NICs and two cable conditions.
Loading 2608.27164v1…