PaperlayerView exact revision on arXiv

Source-linked AI summary

Physical-Layer Fingerprint-Space Capacity Analysis for 100BASE-TX Devices in IIoT

Chenming Zhang, Aiqun Hu

arXiv:2608.27164v1cs.CReess.SP

TL;DR

Reliable authentication is needed for expanding IIoT networks, while the distinguishable capacity of 100BASE-TX physical-layer fingerprints remains insufficiently explored. The paper introduces NAIM to model steady-state and transition waveform differences under waveform and observation constraints. It derives approximately 2.96×10^10 distinguishable states and evaluates empirical capacity and identification using 48 NICs under two cable conditions.

  • Problem

    The distinguishable space and capacity boundary supported by 100BASE-TX physical-layer fingerprints remain largely unexplored, despite the need to prevent device impersonation in IIoT networks.

    Source: §I · pp. 1–2

  • Method

    The paper develops NAIM to represent steady-state level and impulse-response waveform variations, then derives capacity under waveform requirements, observation resolution, and target BER.

    Source: §I · p. 2, §VII · p. 11

  • Results

    Approximately 2.96×10^10 distinguishable states are derived for 100BASE-TX terminals, with experiments using 48 NICs under two cable conditions.

    Source: §I · p. 2, §VII · p. 11

  • Takeaways & Limitations

    Under the 5-m cable condition, empirical capacity and closed-set identification consistently rank the three NIC models, supporting pre-deployment assessment and NIC-model selection.

    Source: §VII · p. 11

Abstract

from arXiv · show

Industrial Internet of Things (IIoT) networks widely adopt Ethernet technologies, such as 100BASE-TX, for industrial communications. As industrial networks continue to scale, reliable device authentication becomes increasingly important for preventing device impersonation and unauthorized access. Physical-layer fingerprinting (PLF) exploits device-dependent fingerprint features in transmitted signals and provides a hardware-based approach for terminal authentication. However, the distinguishable space supported by 100BASE-TX physical-layer fingerprints and its capacity boundary remain largely unexplored. To analyze the capacity of physical-layer fingerprints, this paper proposes a nonlinear and impulse-response model (NAIM) that characterizes device-dependent waveform differences in 100BASE-TX transmitted waveforms. The nonlinear component captures steady-state level deviations, while the impulse-response component describes the transition response during level transitions. The 100BASE-TX transmitter waveform requirements, the observation resolution determined by noise and analog-to-digital conversion (ADC) quantization, and the target bit-error ratio (BER) constrain the admissible fingerprint space. Under the NAIM model, the fingerprint-space capacity of 100BASE-TX terminals is derived as approximately $2.96\times10^{10}$ distinguishable states. Experiments on signals collected from 48 NICs under two cable conditions estimate a Gaussian-equivalent empirical capacity from the measured inter-device and within-device variations. Under the 5-m cable condition, empirical capacity and closed-set identification consistently rank the three NIC models, and a larger empirical capacity yields higher identification accuracy. These results demonstrate that the proposed capacity analysis provides a pre-deployment assessment for physical-layer fingerprinting in IIoT.

I. INTRODUCTION

100BASE-TX physical-layer fingerprints offer hardware-based authentication, but the distinguishable fingerprint-space size remains insufficiently quantified. This paper develops a model-based framework to analyze that capacity from device-dependent waveform variation and practical observation constraints.

  • 100BASE-TX is widely used in IIoT networks because of its mature protocol ecosystem and relatively low deployment cost.Source: §I · p. 1
  • Credential-based access control cannot reliably verify that a credential originates from the claimed physical device, leaving cloned or leaked credentials vulnerable to impersonation.Source: §I · p. 1
  • Physical-layer fingerprinting complements software credentials by exploiting device-dependent variations embedded in transmitted signals.Source: §I · p. 1
  • Existing wired studies mainly evaluate identification on fixed device sets, while the quantitative size of the distinguishable 100BASE-TX fingerprint space has received limited attention.Source: §I · p. 1
  • Experiments characterize practical separability using Gaussian-equivalent empirical capacity and cross-day closed-set identification on measured NICs.Source: §I · p. 2
  • The proposed framework models device-dependent waveform variation with NAIM and evaluates capacity using waveform constraints, observation resolution, and jointly feasible parameter combinations.Source: §I · p. 2

B. Authentication Evaluation and Fingerprint-Space Capacity

The paper traces 100BASE-TX fingerprint variation to the device-dependent analog transmit path after standardized digital encoding. NAIM separates steady-state level deviations from transition dynamics to represent these differences in an interpretable waveform model.

100BASE-TX Transmit Chain and Waveform Differences

MLT-3 Steady-State Level Mapping

C. Impulse Response and Waveform Parameter Vector

The impulse-response component represents post-transition dynamics with a shared fixed basis and device-dependent expansion coefficients. Together with the steady-state parameters, these coefficients form the finite-dimensional NAIM fingerprint vector.

Impulse Response

Waveform Parameter Vector

IV. FINGERPRINT-SPACE CAPACITY ESTIMATION

Fingerprint-space capacity is computed by varying NAIM parameters and counting only waveform states that remain jointly feasible and observable under the model’s coordinate construction.

Fingerprint-Space Capacity Estimation

  • NAIM parameters are varied to generate output waveforms, while transmitter requirements constrain parameter ranges and noise and ADC resolution constrain observable differences.Source: §IV · p. 5
  • Capacity counts jointly feasible parameter combinations because multiple parameters can affect the same output waveform.Source: §IV · p. 5

Fingerprint Coordinate Construction

B. Active Output Interface and Waveform Requirements

The analysis maps NAIM parameters to waveform outputs at the AOI and constrains admissible fingerprints using standard waveform requirements, observation resolution, and BER-related checks.

Parameter mapping

  • The NAIM parameter vector is converted to physical units before evaluating the noiseless waveform against AOI requirements.Only the two steady-state components are scaled; impulse-response coefficients remain unchanged.Source: B. Active Output Interface and… · p. 5

Waveform requirements

  • The capacity calculation uses four time-domain requirement groups: peak output, transient overshoot and settling, amplitude symmetry, and rise/fall timing.The specified bounds include 0.950–1.050 V peak output, 5% overshoot, 8 ns settling, 0.98–1.02 amplitude ratio, and 3–5 ns rise/fall time.Source: B. Active Output Interface and… · p. 5

Observation resolution

  • Observation resolution is modeled through additive noise and ADC quantization, which determine the minimum waveform change counted as distinguishable.The directional step size depends on projected noise and quantization variation.Source: C. Observation Resolution and… · pp. 5–6

Directional analysis

  • The normalized Jacobian uses SVD to identify orthogonal parameter directions and rank them by waveform sensitivity relative to observation noise.Each singular value measures the normalized waveform change produced by a unit perturbation along its corresponding direction.Source: C. Observation Resolution and… · p. 6

BER check

  • A feasible waveform must also retain the target decision margin under the specified timing and noise assumptions.The Gaussian tail function and adopted BASE-T BER objective define the auxiliary threshold check.Source: C. Observation Resolution and… · p. 6

D. Jointly Feasible States and Fingerprint-Space Capacity

Fingerprint-space capacity counts parameter combinations that satisfy waveform constraints jointly, rather than multiplying independent directional ranges, with joint feasibility estimated by RQMC.

Joint feasibility

  • Independent directional state counts cannot simply be multiplied because simultaneous parameter variations interact through the common output waveform.Capacity therefore combines directional ranges with the fraction of combinations that remain feasible.Source: D. Jointly Feasible States and… · pp. 6–7
  • An oblique boundary shows that the allowable range along one parameter direction depends on variation in another direction.In the illustrated cross-section, the main boundary corresponds to waveforms remaining more than 1% from steady state 8 ns after transition onset.Source: D. Jointly Feasible States and… · p. 6
  • One-dimensional feasible intervals are combined into a Cartesian product, then filtered to retain only jointly feasible waveform states.The feasible subset is evaluated after scaling by the normalized scan radius.Source: D. Jointly Feasible States and… · p. 7

Capacity estimation

  • The joint feasibility rate is estimated with randomized quasi-Monte Carlo sampling using scrambled Sobol sequences.Each scramble maps samples into the directional product region and tests the resulting NAIM waveforms against the requirements.Source: D. Jointly Feasible States and… · p. 7

Capacity result

  • Including residual impulse-response coordinates increases the steady-state-only count by approximately 78×.The reported capacity combines waveform requirements, observation resolution, and joint feasibility.Source: D. Jointly Feasible States and… · p. 7

V. EXPERIMENTAL SETUP AND EVALUATION

The evaluation uses 48 NICs from three models under 0.5-m and 5-m cable conditions, with differential waveforms collected across multiple days for reconstruction, capacity estimation, and identification.

Dataset

Acquisition

  • Signals were acquired through either a 0.5-m or 5-m Cat6 UTP cable and formed as the differential waveform CH1−CH2.The observation includes the NIC, cable, terminal load, and measurement chain.Source: A. Experimental Platform and Data… · p. 7

Evaluation protocol

Settings

B. Impulse-Response Extraction and Model Configuration

The paper configures NAIM by extracting normalized impulse responses and representing them with a selected basis, then evaluates fingerprint capacity in a constrained coordinate space. Empirical capacity compares inter-device spread with repeated-measurement variation.

Impulse-Response Extraction

  • An 81-tap FIR response is estimated by ridge regression, mean-removed, normalized to unit ℓ2 norm, and restricted to a band excluding DC and slow drift.The ridge parameter is λridge = 10^-6 max[tr(X^TX)/81, 1].Source: B. Impulse-Response Extraction and… · p. 8

Model Configuration

  • M = 44 impulse-response basis terms are selected by coefficient ranking, correlation pruning at 0.995, and a one-standard-error NMSE rule.The basis is ranked using ridge-projection coefficients against a band-limited reference and the grand-mean response.Source: B. Impulse-Response Extraction and… · p. 8

Capacity Definitions

  • Fingerprint-space capacity quantifies distinguishable waveform states allowed by NAIM under waveform requirements and observation resolution.Empirical capacity instead measures inter-device spread relative to repeated-measurement variation.Source: C. Fingerprint-Space and… · p. 8

Fingerprint-Space Capacity

  • The capacity calculation varies NAIM coordinates, converts steady-state parameters using a reference amplitude, and checks waveform feasibility, observation resolution, and decision margin.The reference amplitude is A0 = 1.302 × 10^4 counts, giving g = 7.678 × 10^-5 V/count for V0 = 1 V.Source: C. Fingerprint-Space and… · p. 8
  • The capacity estimate uses the first d = 16 active SVD directions, with confidence intervals computed across independently scrambled Sobol sets.Source: C. Fingerprint-Space and… · p. 8

Empirical Capacity

  • Gaussian-equivalent empirical capacity uses device-centroid covariance and pooled within-device covariance in the conditioned coordinate space.The within-device covariance includes variation across the three measurement days and is OAS-shrunk.Source: C. Fingerprint-Space and… · p. 8

D. Cross-Day Closed-Set Identification

Cross-day identification uses an OAS–Mahalanobis nearest-centroid classifier with leave-one-day-out testing at 5 m. The reconstruction results show that the 44-term NAIM captures the main temporal and spectral structure under both cable conditions.

Cross-Day Identification

Reconstruction Results

  • The median NMSEs are 0.023 for 0.5 m and 0.033 for 5 m, while median in-band energies are 72.2% and 67.6%, respectively.The upper-quartile NMSE does not exceed 0.047 under either cable condition.Source: A. Reconstruction Results of the… · p. 9
  • The 44 impulse-response parameters capture the main temporal and spectral structure of the estimated in-band response under both cable conditions.Reconstructions follow major time-domain peaks and decay, as well as spectral peaks and notches over 1–200 MHz.Source: A. Reconstruction Results of the… · p. 9

B. Fingerprint-Space Capacity and Industrial-Scale Context

Within the retained 16-direction subspace, jointly feasible waveform variations yield approximately 2.96 × 10^10 distinguishable states at ρ = 1, while empirical capacity characterizes separability in measured NICs under specific cable conditions.

Model-based capacity

  • 2.96 × 10^10 distinguishable states are estimated at ρ = 1 and kσ = 1 within the retained 16-direction subspace.The first 16 SVD directions account for 99.991% of the total squared singular-value sum.Source: B. Fingerprint-Space Capacity and… · p. 9
  • 1.86 × 10^13 independent-direction states reduce to 2.96 × 10^10 jointly feasible states, a factor-of-628 reduction from directional coupling.Joint variation through the common output waveform can violate waveform requirements even when each direction is individually admissible.Source: B. Fingerprint-Space Capacity and… · p. 9
  • [2.54 × 10^10, 3.37 × 10^10] is the 95% confidence interval from eight RQMC estimates at the reference setting.The interval preserves the 10^10-state scale.Source: B. Fingerprint-Space Capacity and… · p. 9

Empirical capacity

  • 1.63 × 10^3 and 2.44 × 10^5 distinguishable devices are the Gaussian-equivalent empirical capacities at 0.5 m and 5 m, respectively.These estimates characterize inter-device spread relative to repeated-measurement variation in the measured device set.Source: C. Gaussian-Equivalent Empirical… · p. 10

Measurement sensitivity

  • Omitting the third 0.5-m acquisition increases empirical capacity from approximately 1.63 × 10^3 to 2.05 × 10^5 distinguishable devices.The third acquisition followed cable reconnection and used a different physical cable arrangement.Source: C. Gaussian-Equivalent Empirical… · p. 10

D. Closed-Set Identification and NIC-Model Comparison

Under the 5-m cable condition, closed-set identification and empirical capacity consistently rank the three NIC models. The results connect larger empirical capacity with stronger device separability and support pre-deployment NIC-model assessment.

Closed-Set Identification

NIC-Model Comparison

  • The three NIC models largely occupy different regions in the first two principal components.The projection explains about 85.9% of the variance, and RTL8152B contains two sub-clusters.Source: D. Closed-Set Identification and… · p. 11
  • RTL8152B, AX88772, and CH9151 have identical rankings in empirical capacity and cross-day Top-1 accuracy.This agreement links empirical capacity with device separability preserved across days.Source: D. Closed-Set Identification and… · p. 11

Implications

  • The proposed capacity analysis provides a pre-deployment assessment for physical-layer fingerprinting and can guide NIC-model selection.Experiments on 48 NICs under the 5-m cable condition support this application.Source: §VII · p. 11

Limitations and Future Work

  • Future work will examine temperature variation, longer-term drift, cable-length variation, and larger device populations.The stated extension scope goes beyond the evaluated 48 NICs and two cable conditions.Source: §VII · p. 11
Loading 2608.27164v1…