# Radio Frequency Fingerprint Identification for 5G Mobile Devices Using DCTF and Deep Learning
## 2 RFF Extraction Based on a 5G NR PRACH Preamble
### Formula for the 5G PRACH Preamble  
In a 5G system, the gNB periodically broadcasts the synchronization block (SSB), which consists of the primary synchronization signal (PSS), secondary synchronization signal (SSS) and physical broadcast channel (PBCH). Mobile phone terminals initiate random access procedures with the gNB upon receiving the SSB. During this random access process, three primary uplink channels are used, such as the physical uplink control channel (PUCCH), physical uplink shared channel (PUSCH) and PRACH. The PUSCH and PUCCH are responsible for transmitting uplink data and uplink control signaling, respectively. However, due to variations in the frame format and frequency band, the PUSCH and PUCCH are less suitable for RF fingerprint extraction. On the other hand, the PRACH is used for uplink synchronization between the user equipment (UE) and the gNB. The PRACH signal is the first signal the UE sends to the gNB, characterized by a fixed bandwidth and frequency assigned by the base station. Due to the random access mechanism, each UE selects one of the 64 randomly assigned PRACH sequences. However, since the PRACH signal does not carry any identity information, the gNB cannot detect malicious access UE through the PRACH signal. This enables potential flooding attacks based on PRACH signals, and existing 3 rd Generation Partnership Project (3 GPP) specifications do not have any preventive measures against such attack methods [1]. The PRACH preamble consists of a cyclic prefix (CP) and several repeated preamble sequences generated using the Zadoff-Chu (ZC) sequence. Figure 1 illustrates the time domain structure of the PRACH preamble format A2, where four ZC sequences are repeated in one frame. The ZC sequence, a kind of constant-amplitude zero autocorrelation sequence (CAZAC), possesses desirable properties, such as a constant envelope and ideal periodic autocorrelation and cross-correlation characteristics [32; 33]. Moreover, the Fourier transformation does not alter the characteristics of the ZC sequence. The ZC sequence can be generated using the following equation:  
\[x_{\mu}[i]=e^{-j\frac{\pi\mu(i+1)}{L_{\mathrm{ZC}}}},\;i=0,1,\cdots,L_{\mathrm{ ZC}}-1 \tag{1}\]  
where \(L_{\mathrm{ZC}}\) is the length of the ZC sequence. Referring to 3 GPP technical specification (TS) 38.211 in Table 6.3.3.1-1 and Table 6.3.3.1-2 in [34], we observe that 5G supports four types of long sequence preambles with a length of 839 and nine types of short sequence preambles with a length of 139. The high-level parameter \"prach_RootSequenceIndex_PR\"  
Figure 1: Structure of PRACH preamble format A2. determines the specific length of the preamble sequence, where \(\mu\) represents the root of the ZC sequence. Once the root sequence is generated as \(\lfloor L_{ZC}/N_{CS}\rfloor-1\), other ZC sequences can be created by applying a cyclic shift to the root sequence, where \(\lfloor\cdot\rfloor\) represents the floor value and \(N_{CS}\) is the step size for the cyclic shift, while the value of \(N_{CS}\) can be derived from Table 6.3.3.1-7 in TS 38.211 [34]. Hence, the \(v^{th}\) sequence generated using the root value \(\mu\) can be expressed as  
\[x_{u}^{v}[i]=x_{u}[(i+C_{v})\ mod\ L_{ZC}],\ i=0,1,\cdots,L_{ZC}-1 \tag{2}\]  
\[C_{v}=vN_{CS},\ v=0,1,\cdots,\lfloor L_{ZC}/N_{CS}\rfloor-1 \tag{3}\]  
where \(C_{v}\) is called the cyclic shift value. Since each cell requires 64 preamble sequences, if the root sequence does not yield 64 ZC sequences (e.g., when \(N_{CS}=34\) and \(L_{ZC}=139\)), then we have \(\lfloor L_{ZC}/N_{CS}\rfloor=4\), indicating that only 4 ZC sequences can be generated based on one root value. In this case, 16 root values are required to generate all 64 preamble sequences. The first root is determined by the base station parameter \"prach_RootSequencIndex\", and the other roots are the natural numbers following the first root. We note that these root values are logical roots, and the corresponding physical roots can be found in Table 6.3.3.1-4 in TS 38.211 [34], denoted as \(\mu\) in the formula.