- The paper introduces a deep learning-based 1D SE-ResNet model achieving an EER of 3.92% for physical layer authentication using real 5G NR SRS data.
- It employs a high-dimensional, multidomain feature set—including subcarrier amplitudes and phase differentials—to capture robust device fingerprints.
- The study emphasizes temporal generalization with session-aware splits, revealing performance inflation from random splits due to temporal leakage.
Deep Learning-Based Physical Layer Authentication Using 5G NR SRS: Temporal Generalization Analysis
Introduction
Physical Layer Authentication (PLA) exploits the spatial uniqueness of wireless channels as a means to authenticate transmitters independently from upper-layer cryptographic mechanisms. This device fingerprinting paradigm is especially relevant in the context of 5G New Radio (NR) due to the substantial richness introduced by the Sounding Reference Signal (SRS), which affords fine-grained, per-subcarrier channel observations. The paper under examination presents a technically rigorous study of deep learning-based PLA employing real 5G NR SRS data collected from an OpenAirInterface (OAI) testbed, focusing specifically on the critical issue of temporal generalization, i.e., evaluating authentication models under chronologically separated train/test splits to prevent temporal leakage.
System and Data Acquisition
The experimental platform consists of a 5G NR gNB and User Equipments (UEs), implemented on USRP B210 SDRs and commercial handsets, operating in 3.5 GHz (band n78) with 40 MHz bandwidth and 1 × 1 SISO configuration. The dataset encompasses over 20,000 SRS probes emanating from four discrete measurement sessions, capturing both legitimate (SDR-based) and adversarial (commercial handset) transmissions under varying environmental and device conditions. The T_tracer facility of OAI is leveraged to extract raw uplink channel estimates at PHY layer granularity: frequency-domain channel state information (CSI), time-domain impulse responses, SNR estimates, and precise time-of-arrival (ToA) metrics.
Feature Engineering
A high-dimensional (2,531-d) feature vector is extracted from each SRS probe, spanning six distinct domains:
- Per-subcarrier amplitude (1,248-d): Retention of raw subcarrier amplitudes to preserve fine-grained frequency selectivity.
- Differential phase (1,247-d): Adjacent subcarrier phase differentials to mitigate device-state-dependent linear phase drifts.
- Power delay profile and delay spread (16-d): RMS delay spread, ToA, top PDP taps, coherence bandwidth, and amplitude statistics.
- Doppler and temporal dynamics (8-d): Windowed Doppler shift, coherence time, and inter-probe temporal statistics.
- Nonlinear dynamics indicators (12-d): Wavelet variance at dyadic scales, sample entropy, fractal dimension, Lyapunov exponent, and recurrence quantification to assess analog front-end hardware impairments.
This multidomain construction is highly relevant for capturing both propagation-induced and hardware-induced device discriminants.
Authentication Models and Training
The classification model is a 1D Residual Network (ResNet) architecture with Squeeze-and-Excitation (SE) attention mechanisms, comprising 3.59M parameters. The model is trained using Adam with mixup augmentation, label smoothing, and cosine-annealing learning rate schedule. The baseline comparator is a classical thresholding classifier based on Pearson correlation of probe amplitudes to a per-device enrollment mean.
To eliminate the positive bias from temporal autocorrelation, a strict chronological split is enforced within each recording session for training (70%), validation (15%), and testing (15%)—contrasting with the commonly used (but problematic) random split which allows temporally contiguous samples to leak across training and testing boundaries.
Experimental Results
Under temporally strict evaluation, the SE-ResNet1D attains an Equal Error Rate (EER) of 3.92% (AUC = 0.962, test accuracy 97.5%), with authentication latency below 0.1 ms per probe, which is compatible with 5G URLLC constraints. The Pearson correlation threshold baseline lags behind, substantiating the value of deep learning in extracting robust device-channel fingerprints.
Critically, random splitting inflates performance, yielding an EER of 2.58%, which the authors attribute directly to temporal leakage. The 1.34 percentage-point EER gap robustly quantifies the overestimation induced by train/test contamination observed in prior art.
The distributional analysis reveals that legitimate authentication scores cluster tightly near unity, whereas adversarial probes distribute broadly, with some overlap reflecting inevitable channel coincidences under SISO. The prevalence of undetected attacks at the false rejection/acceptance equilibrium is dominated by those probes where the hardware and environmental characteristics of the attacker transiently align with the legitimate device—a limitation inherent in single-antenna channel-based PLA.
The numerical results are benchmarked against leading work: previous real-data PLA studies (often on WiFi/LTE) report EERs in the 3.8–8% range, but are typically evaluated with random splits or synthetic data. The presented approach remains competitive despite stricter methodology and the use of real over-the-air 5G NR data.
Practical Implications and Theoretical Insights
The findings substantiate the operational viability of deep learning-based PLA for SRS-enabled 5G NR, with the proposed approach meeting the low-latency demands of URLLC and achieving cross-device, cross-hardware generalization under realistic conditions. The adoption of temporally honest evaluation is shown to be essential for any meaningful assessment of PLA performance.
For practical deployment, the model and pipeline are computationally tractable for real-time base station operation, with moderate memory and processing requirements. The high dimensionality and multidomain features suggest robustness to simple replay or channel manipulation attacks, although the vulnerability surface against sophisticated, adaptive adversaries with more extensive hardware mimicry or adversarial ML capabilities is not addressed in this study.
On the theoretical front, the work highlights the importance of both the propagation channel statistics and RF hardware impairments as complementary axes for physical layer fingerprinting. It also underscores the susceptibility of PLA metrics to data partitioning biases: in temporally correlated wireless environments, only session-aware or chronological splits yield estimates relevant for deployment.
Future Directions
The authors identify several key limitations and future research vectors:
- Extension to MIMO configurations to amplify spatial discriminants;
- Integration of additional reference signals (e.g., DMRS) for continuous authentication;
- Expansion and diversification of attacker datasets;
- Adversarial training methods to enhance resilience to sophisticated spoofing.
Exploration of PLA in highly dynamic or high-mobility scenarios and quantification of performance against sophisticated, resourceful adversaries are pressing open problems. Further, the integration of physical layer authentication with upper-layer security protocols in an end-to-end secure 5G/6G stack remains an attractive system-level goal.
Conclusion
This paper provides a technically comprehensive evaluation of deep learning-based physical layer authentication using 5G NR SRS in the presence of real environmental and device variability. The rigorous focus on temporal generalization reveals the limitations of prior assessment protocols and sets a methodological benchmark for future PLA studies. The 1D SE-ResNet architecture, combined with a broad multidomain feature set, achieves competitive EER with sub-millisecond latency, demonstrating the feasibility of deploying deep PLA on modern 5G infrastructure. Prospective work on spatial diversity, continuous authentication, attack modeling, and adversarial defenses will further clarify the ultimate security guarantees of this class of techniques.