Key Takeaways
Two circuit boards. Same manufacturer, same model, same firmware, sending byte-identical messages. One of them is counterfeit.
Nothing in the software can separate them. A cloned device carries valid credentials and looks completely legitimate to every check the system performs.
To solve this vulnerability, researchers at the Information Systems, Security, and Forensics (ISSF) Laboratory at the University of Michigan-Dearborn developed a hardware authentication framework that identifies individual embedded devices by analyzing the intrinsic analog shape of their digital switching signals. By leveraging the on-board processing and high-speed data acquisition of the Red Pitaya STEMlab 125-14 PRO Gen 2, the team built an end-to-end, real-time authentication pipeline that eliminates the need for a host PC.
“You can copy firmware, a serial number, or a message. You cannot copy physics.”
Modern vehicles contain over 100 Electronic Control Units (ECUs) communicating via CAN bus, LIN, and Ethernet. Similarly, industrial cyber-physical systems—from robotic arms on a factory floor to medical equipment—rely on embedded controllers communicating via digital ON/OFF switching signals.
Today’s security frameworks rely heavily on cryptographic authentication (such as SecOC in AUTOSAR). While cryptography effectively verifies message integrity, it cannot detect hardware-level substitution attacks. If an adversary physically replaces a legitimate ECU with an identical-model clone programmed with modified firmware and transferred credentials, the software will accept the impostor as legitimate.
“Cryptography checks the badge. It has no way to check the hand holding it.”
When two devices send identical digital payloads—such as byte-identical messages like 0x1A4—traditional cryptographic checks validate both as authentic because they possess the same firmware and data. However, evaluating physical-layer transients reveals clear structural differences. While a genuine ECU might exhibit a rising edge of 8.2 ns and pass verification, a counterfeit unit with an 11.4 ns rise time is immediately flagged and rejected.
To answer the fundamental question—“Is this the same physical ECU that was originally installed?”—security systems must evaluate properties below the software abstraction layer.,
Modern vehicles contain over 100 Electronic Control Units (ECUs) communicating via CAN bus, LIN, and Ethernet. Similarly, industrial cyber-physical systems—from robotic arms on a factory floor to medical equipment—rely on embedded controllers communicating via digital ON/OFF switching signals.
Today’s security frameworks rely heavily on cryptographic authentication (such as SecOC in AUTOSAR). While cryptography effectively verifies message integrity, it cannot detect hardware-level substitution attacks. If an adversary physically replaces a legitimate ECU with an identical-model clone programmed with modified firmware and transferred credentials, the software will accept the impostor as legitimate.
“Cryptography checks the badge. It has no way to check the hand holding it.”
When two devices send identical digital payloads—such as byte-identical messages like 0x1A4—traditional cryptographic checks validate both as authentic because they possess the same firmware and data. However, evaluating physical-layer transients reveals clear structural differences. While a genuine ECU might exhibit a rising edge of 8.2 ns and pass verification, a counterfeit unit with an 11.4 ns rise time is immediately flagged and rejected.
To answer the fundamental question—“Is this the same physical ECU that was originally installed?”—security systems must evaluate properties below the software abstraction layer.
Historically, physical-layer hardware fingerprinting research suffered from a major deployment bottleneck: reliance on bulky laboratory bench oscilloscopes sampling at 2.5 GS/s, tethered to high-performance workstations.
“Published work in this field relied on bench oscilloscopes running at 2.5 GS/s, tethered to a workstation. That is exactly why none of it ever reached a vehicle.”
To build a field-deployable system, the UM-Dearborn researchers selected the Red Pitaya STEMlab 125-14 PRO Gen 2 running in high-voltage mode. By organizing the acquisition and processing system around the Red Pitaya's internal hardware architecture, the team created a self-contained pipeline. The board's analog front-end uses dual 14-bit ADCs sampling at 125 MS/s to feed digitized signals into a deep DMA buffer (capable of storing 16,000 to 2,000,000 samples) within the FPGA fabric. From there, data streams directly into the dual-core ARM Cortex-A9 processor running an embedded Linux environment inside a Docker container to perform real-time machine learning inference.
The authentication system operates across two main operational phases: an Enrollment Phase and an Authentication Phase. During enrollment, target devices generate a 1 MHz PWM stimulus while connected to a host PC monitoring setup. The Red Pitaya STEMlab 125-14 captures a 16,384-sample window per trigger, extracts a 211-dimensional feature vector, and populates the enrollment database with trained models. During the authentication phase, an unknown input device undergoes the exact same capture and extraction steps directly on the Red Pitaya.
The 211-dimensional feature vector combines two complementary extraction methods:
1. Cycle-Based Features (94 Features): Extracts metrics per switching cycle across five categories: timing (rise time tr=t90%−t10%, duty cycle), shape (overshoot amplitude, ringing frequency), edge transitions, stability, and aggregate statistics.
2. Enhanced Global Features (117 Features): Captures holistic signal characteristics using time-domain statistics (15 features), Discrete Wavelet Transform (Daubechies-4, 18 features), statistical moments (24 features), frequency-domain spectral centroids (42 features), and edge analysis (18 features).
Feature importance analysis showed that transition timing features—specifically rise time, fall time, and their statistical moments—accounted for 6 of the top 10 discriminative features.
The framework was evaluated across 8 embedded devices spanning 4 distinct hardware families (Arduino UNO R3, Elegoo UNO R3, STM32F4 Discovery, and Analog Discovery 3), explicitly including same-model clone pairs.
Under controlled mounting conditions using non-conductive standoffs, the real-time device identification accuracy reached 99.5% (and 93.6% without controlled mounting). Across all tests, the device hardware type classification accuracy remained at 100.0%.
The framework employs a two-stage hybrid classifier:
If the model returns a confidence score meeting or exceeding the threshold, it outputs a verified device identity (e.g., Device D1). If the confidence score falls below the threshold, the system gracefully degrades to reporting the guaranteed hardware type label (e.g., "Arduino - Unknown Device") rather than misidentifying an individual board. This method was subsequently validated on a fleet of 9 electrically identical production automotive ECUs from a commercial vehicle platform.
A primary challenge in analog fingerprinting is proving that the system measures the device under test rather than artifacts of the acquisition instrument.
To verify measurement integrity, the team utilized the Red Pitaya’s built-in signal generator, looping Output 1 (OUT1) directly back into Input 2 (IN2). By measuring how much the acquisition path distorted a known synthesized signal, the team confirmed that all key diagnostic features were preserved:
Having an integrated signal generator and high-speed digitizer on a single board simplified instrument self-calibration, avoiding the need for external reference sources.
The ability to perform non-invasive, physical-layer authentication using a compact, low-cost platform like the Red Pitaya STEMlab 125-14 opens new possibilities for embedded cybersecurity:
By moving the entire machine learning inference pipeline directly onto the ARM processor of the acquisition board, this research demonstrates that physical-layer device fingerprinting can transition from a benchtop laboratory concept into a field-deployable security layer.
This research was led by Abbas Ali, PhD student at the University of Michigan-Dearborn, working alongside Prof. Hafiz Malik in the Information Systems, Security, and Forensics (ISSF) Laboratory.
Their paper, "Short: Is Your ECU Really Yours?", was presented at the 4th USENIX Symposium on Vehicle Security and Privacy (VehicleSec 2026) in Baltimore, MD. The complete technical paper, open-access proceedings, and presentation slides are available directly on theUSENIX page. Furthermore, the paper earned all three USENIX Artifact Badges (Available, Functional, Reproduced). To support open security research, the complete dataset of 48,000 raw waveforms (2.6 GB), pre-extracted 211-D feature CSVs, pre-trained machine learning models, and Jupyter evaluation notebooks are publicly archived on Zenodo (DOI: 10.5281/zenodo.19666939).
Cryptography verifies that a message carries a valid signature or token, but it cannot verify the physical origin of the signal. If an attacker clones an ECU's firmware and cryptographic credentials onto counterfeit hardware, software-level checks accept the impostor as legitimate. Physical-layer fingerprinting checks the hardware itself.
Bench oscilloscopes sampling at 2.5 GS/s are expensive and require a tethered host workstation, making vehicle or field deployment impossible. The Red Pitaya combines 14-bit 125 MS/s ADCs with an onboard ARM processor, enabling high-resolution signal capture and real-time ML inference on a single, hand-sized board.
No. The system operates completely non-invasively by probing digital lines (such as GPIO toggles or CAN bus lines) during normal operation. It requires no firmware modifications, internal SRAM reads, or custom silicon modifications.
Using the STEMlab’s two synchronized input channels, the system captures CAN_H and CAN_L simultaneously. Analyzing each line individually alongside the differential signal reveals output driver asymmetries that standard differential receivers filter out, providing richer fingerprint features.