PHY Authentication for Ambient IoTs in Near-Field XL-MIMO Backscatter Communication Systems

Source: arXiv:2607.22134 · Published 2026-07-24 · By Fikiri Salum Uledi, Hafsa Ahmad, Muhammad Bilal Janjua, Cagri Ozgenc Etemoglu, Huseyin Arslan

TL;DR

This paper addresses the challenge of lightweight, physical-layer authentication (PLA) of backscatter devices (BDs) in ambient IoT (A-IoT) systems using extremely large-scale multiple-input multiple-output (XL-MIMO) near-field (NF) propagation. Traditional cryptographic approaches are infeasible for constrained BDs, and existing PLA methods often overlook geometry-dependent physical features. The authors propose a novel binary element-wise delay shift keying (EW-DSK) modulation scheme on a multi-antenna BD, which embeds deterministic bit-dependent delays that shift per-antenna power delay profiles (PDPs) while preserving NF spherical wavefront curvature. This geometry-induced delay-curvature signature is extracted and used in a hypothesis test for authentication, aimed at countering impersonation (spoofing) attacks from attackers attempting to mimic BD signals. Through analytical modeling and extensive simulations, the authors demonstrate that their approach significantly improves authentication accuracy and reduces spoofing success probability (SSP), especially as the spatial offset between attacker and legitimate BD grows, the SNR increases, or effective bandwidth widens. Compared to a baseline covariance-fingerprint scheme, the proposed EW-DSK method achieves better receiver operating characteristic (ROC) performance, making it promising for secure, low-complexity ambient backscatter IoT scenarios in NF XL-MIMO channels.

Key findings

• The proposed EW-DSK scheme achieves a clear curvature profile shift between bit states, enabling discriminative bit-dependent physical signatures (Fig. 3).
• Curvature separability index Jsep increases monotonically with normalized delay-resolution index ρres, demonstrating improved bit-state discrimination with higher induced delay (Fig. 4).
• Curvature-estimation RMSE decreases significantly with increasing SNR and effective bandwidth (Beff), showing more reliable signature extraction under better channel conditions (Fig. 5).
• ROC performance improves considerably as attacker-to-legitimate user spatial offset increases, with detection probability PD approaching 1 for offsets ≥5 m at moderate SNRs, outperforming baseline [9] (Fig. 6).
• Spoofing success probability (SSP) remains near 1 when attacker is colocated with legitimate BD, but decreases monotonically with increased offset and higher SNRs, verifying geometry-driven security property (Fig. 7).
• Analytical model relates PDP curvature extraction error and antenna aperture geometry to overall signature uncertainty, confirming trade-offs in threshold design and performance.
• Computational complexity for signature extraction is dominated by per-antenna FFT PDP estimation O(MN log N) plus delay-bin search and quadratic fitting.
• The choice of delay offset δb bounded by delay-resolution and near-field delay spread constraints optimizes signature separability while preserving NF propagation characteristics.

Threat model

The adversary is a clone-reflector spoofer who passively re-transmits the ambient base station signal attempting to impersonate a legitimate backscatter device. The attacker cannot physically replicate the exact near-field geometry, including device location and resulting spherical wavefront curvature-induced delay profiles, that form the authentication signatures. The attacker operates under quasi-static channel conditions and tries to maximize similarity to the legitimate BD signal, but cannot overcome the fundamental geometry-induced signature differences exploited by the system.

Methodology — deep read

1. Threat Model and Assumptions: The adversary is a clone-reflector spoofer (Eve) who attempts to mimic the legitimate backscatter device (Alice) signal to deceive the XL-MIMO receiver (Bob). Eve knows the ambient Tx signal but cannot physically replicate Alice’s exact position or NF propagation signature. The channel is assumed quasi-static during enrollment and authentication phases, allowing stable geometry-dependent signatures. The direct Tx-Bob link is assumed to be suppressed or canceled, leaving predominantly backscatter signals for analysis. Residual interference and hardware impairments are acknowledged but not modeled in detail.

2. Data and Signal Model: The system employs OFDM ambient backscatter communication with a large linear antenna array of M=128 elements (Bob) spaced at half wavelength (λ/2). Alice has a multi-antenna BD architecture with two antenna elements spaced λ/2 apart, enabling element-wise switching and imposed deterministic delay δb for bit modulation. The effective bandwidth Beff is set (e.g., 0.96 MHz), and channel delay profiles follow near-field spherical wavefront geometry. The received signal y(t) at Bob includes direct link, backscatter from Alice, and additive noise.

3. Proposed Modulation and Signature Extraction: The EW-DSK scheme transmits bit '0' by activating antenna element 1 with zero delay, bit '1' by activating element 2 with additional delay δb. This causes a bit-dependent shift in the PDP across Bob’s antennas, while preserving NF quadratic curvature due to spherical wavefront propagation. Per-antenna PDPs are estimated via FFT, detecting the dominant delay peak. Delay-curvature signatures s = [bd1, bd2] are obtained by quadratic curve fitting to per-antenna delays over array aperture coordinates. This signature compactly captures NF propagation geometry influenced by bit-induced delay offset.

4. Authentication Test Design: During enrollment, Bob stores legitimate signatures s(ref) for both bit states. On new observations, Bob computes the minimum Euclidean distance η between observed s(obs) and reference s(ref). A hypothesis test compares η to threshold ηth, chosen to control false alarm probability (PFA). Decision hypotheses are Ha (legitimate) if η ≤ ηth, He (illegitimate) if η > ηth. Analytical derivations model η statistics using Rayleigh and Rician distributions under legitimate and attack hypotheses.

5. Performance Analysis: The paper derives the covariance of least-squares quadratic curve fitting to characterize signature estimation error, showing dependence on noise variance, aperture geometry, and bandwidth. Threshold ηth depends on estimated signature uncertainty σs and target PFA. Spoofing detection probability PD and spoofer success probability SSP depend on signature separation Δs and σs. Simulations vary SNR, bandwidth, Eve’s spatial offset, and induced delay δb to evaluate ROC, SSP, and curvature RMSE.

6. Evaluation Protocol: Simulations use parameters at 7 GHz carrier frequency with 128 element Bob array, Alice at 25m distance, Eve offset from 0 to 10m. Performance metrics include curvature estimation RMSE, ROC curves (PD vs PFA), SSP, and curvature separability index Jsep. The proposed scheme is benchmarked against a recent covariance-based PLA baseline [9]. No cross-validation or code release is mentioned. Residual direct-link interference is assumed fully suppressed but acknowledged as future work.

7. Example Workflow: For bit '1', Alice activates antenna element 2 with induced delay δb = 10 μs. Bob receives the backscatter signal at all 128 antennas, estimates the PDP via FFT, extracts the dominant delay peak per antenna, and fits a quadratic curve to the delay profile. The resulting curvature coefficients bd1, bd2 form the signature s(obs). Bob compares s(obs) to stored s(ref) for authentication, accepting or rejecting based on threshold ηth. Variations in Eve’s spatial offset alter the spoofed signature, allowing detection as Eve moves away from Alice.

Technical innovations

• Introduction of a binary element-wise delay shift keying (EW-DSK) modulation on a multi-antenna BD with delay-imposed bit states that intentionally embed geometry-tied near-field delay-curvature signatures.
• Development of a compact per-antenna power delay profile (PDP) curvature extraction framework based on quadratic fitting of NF spherical wavefront delays across an XL-MIMO aperture.
• Design of a false-alarm-controlled hypothesis testing authentication mechanism leveraging the extracted delay-curvature signatures to mitigate impersonation in ambient backscatter scenarios.
• Analytical modeling linking per-antenna PDP estimation errors, aperture geometry, and signature estimation uncertainty, enabling quantitative threshold and spoofing performance predictions.

Baselines vs proposed

• Baseline [9] covariance-fingerprint PLA: ROC performance markedly inferior to proposed EW-DSK scheme at same Eve spatial offset (e.g., at ∆x=2m ROC diagonal vs improved ROC in Fig. 6).
• Proposed scheme at SNR=20 dB and ∆x=10 m: Detection probability PD approaches 1 while baseline remains significantly lower.

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.22134.

Fig 1: System model.

Fig 2: System geometry.

Fig 3: PDP curvature for the bit states.

Fig 4: Curvature separability index.

Fig 5: shows curvature-estimation root-mean square error

Limitations

• The authentication performance deteriorates sharply when attacker is nearly co-located with legitimate BD (within ~2m), leaving room for physical proximity attacks.
• Residual direct-link interference is assumed fully suppressed, but its practical impact on PDP extraction and authentication error is not experimentally evaluated.
• The channel and spatial geometry are assumed quasi-static; time-varying or mobile scenarios are not addressed, limiting applicability in dynamic environments.
• The study relies on simulated data and analytic models without real-world measurements or hardware validation.
• Limited exploration of robustness against advanced adversarial attacks such as adaptive or intelligent spoofers tailoring signals to mimic curvature signatures.

Open questions / follow-ons

• How robust is the proposed delay-curvature signature authentication under realistic time-varying or mobile channel conditions?
• Can joint optimization of antenna element spacing and induced delay δb improve signature separability and security further?
• What are the effects of residual direct-link interference and hardware impairments on signature extraction accuracy and false alarm rates?
• How effective is the scheme against more sophisticated adversaries who adaptively modify transmitted waveforms to mimic legitimate signatures?

Why it matters for bot defense

The work presents a novel physical-layer authentication approach that leverages near-field propagation signatures unique to device geometry and multi-antenna backscatter modulation. For bot-defense and CAPTCHA researchers, this introduces a promising source of hardware-tied, physics-rooted fingerprints that are lightweight to generate at passive IoT devices yet hard for attackers to replicate without physical proximity. Integrating such delay-curvature signatures as physical challenges could enhance security against impersonation bots that cannot reproduce fine-grained spatial wavefront patterns. However, the approach’s reliance on quasi-static channels and spatial resolution requirements indicates the need for carefully designed challenge-response protocols considering environment dynamics and attacker capabilities. Overall, leveraging geometry-dependent signatures provides a complementary physical hardening mechanism to bolster CAPTCHA and bot-detection systems in dense IoT deployments.

Cite

@article{arxiv2607_22134,
  title={ PHY Authentication for Ambient IoTs in Near-Field XL-MIMO Backscatter Communication Systems },
  author={ Fikiri Salum Uledi and Hafsa Ahmad and Muhammad Bilal Janjua and Cagri Ozgenc Etemoglu and Huseyin Arslan },
  journal={arXiv preprint arXiv:2607.22134},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.22134}
}

Read the full paper

• arXiv:2607.22134 (abstract)
• arXiv:2607.22134 (PDF)