*35C3 preroll music*
Friederike: I will give you a short introduction to
software defined radio. So some basics about this technology and some modulation
technology which your also always need if you want to transmit something. First of
all before we come to the software defined radio let's first have a look about what
generally happens in a radio transmission, so the parts you always need to get
something over the air. Normally you have some input signal you want to transmit, an
audio signal, a radio for example, a video signal or just any data. Then you do some
compression. Mostly you do this if you have some digital stuff in analog. You
don't do this so much, some error correction, modulation and then the
frequency assignment to the frequency you want to use for the transmission.
Then you have a radio channel. Sometimes you have mobility if you move. You have a
multi-path propagation. You always have some noise added and often there are also
like other signals in the air which also share the channel. And then at the other
side it goes the other way round. You get the demodulation, error correction if
there are errors and the decompression and hopefully outcomes here original audio or
video signal or the data you had transmitted. A bit to the frequency
assignment: there are frequency plans. Here you can see a frequency plan of the
US. They had a nice chart like this here for example you can see the frequency band
from 88 to 108 megahertz then some aeronautical services and other stuff at
the other frequencies for Europe. They have a really huge table. You can find it
on the website of the ECO - the European Communications Office. Yeah it's quite
large. But if you want to look what's probably on this frequency in the air you
can have a look there. So now let's start with a not software defined radio to get a
bit more used to the principles. What does happen there. Here's for example an old AM
receiver in this on this side. So we get the signal in the air, the AM
transmission. There are still some but they are actually switched off at the
moment. Here now we have a superheterodyne receiver, it's called like this. So what
we have, we have where is my mouse, here is my mouse. So we have here at the
antenna, here is the antenna, we have our signal S1. That's the signal we want to
receive. Then we have some filtering to get rid of all the other signals which are
farther away. Then we have our mixer here. So the LO
frequency of this mixer, like the local oscillator frequency here, is always
chosen in the way that the wanted signal always falls in the same intermediate
frequency. With this you can have a very sharp filter here. The IF filter. So at
your IF fillter output you only get the wanted signal which then, after the
filtering, again some amplification, goes to the demodulator and in the case of AM
now all your information is actually in the amplitude of the signal. So for
decoding and listening the easiest way would be just an envelope detector which
could look like this. You have a diode which actually puts the negative part of
the signal to the positive side. And then here we just use a low pass to get rid of
the intermediate frequency which you can still see here. And afterwards you can
just listen to your audio signal. So in the case of software defined radio we stay
to the to the RX front end in these examples. The TX path would be nearly
similar the other way around. So again, we have the antenna. Antennas are also really
important. Always take a good well adapted antenna to the frequency you want to
receive or the frequency you want to transmit, because otherwise you won't get
any signal out of the air or only a very low part of the signal. I gave a talk on
antennas at 31C3. So if you're interested in antennas you can have a look on
media.ccc.de. Then again we again have some filteirng, an amplifier, and now we
have an IQ mixer. Here you can see it actually consists of
two mixers and this local oscillator signal is shifted by 90 degrees to the
lower part here of our signal. Then again some filtering, amplification and then we
get the analog to digital converters here to get our IQ signal then to the computer
for decoding and software. We still have actually a big analog part
here. So most of the front end is still an analog and the digital part actually is
only this after the analog to digital converter. In this case of a classical
software defined radio front end. IQ data are pretty cool, they contain actually the
raw signal that is coming out of the air. You could also record the raw signal. It's
fastly getting huge. And for example do then the demodulation later. If you put
those IQ signals on a coordinate plane, which you can see here on the right side,
you can see also the phase shift of 90 degrees between the I, which is the
inphase component, and the Q which is the quadrature component of the signal. If you
assigns some numbers, we can also combine them with a vector. We can use Pythagoras
for example to get the amplitude of the resulting vector, we can do some
trigonometry to get the angle. Actually those two parameters like the
angle and the amplitude are the main parameters you can put information in. So
in the example before, like the AM modulation, you only use actually the
amplitude of the signal. In contrast to this an FM modulation for example has a
constant amplitude and all the information is put to the to the phase or the
frequency. So no matter what kind of modulation is used, these IQ data actually
contain all the necessary information. A nice example of a modulation which is
often used nowadays and that also uses both of those parameters is the QAM
modulation. OK, I already told this. The QAM modulation here for example is a
constellation diagram out of the program GNURadio.
Oh it's a bit shifted everything, doesn't matter. So here again we have our inphase
component on the x axis and the quadrature component on the vertical axis with the
4-QAM we have four symbols, so we can put in two bits per symbol. A 16-QAM for
example you can put in four bits per symbol. If we go further, 64-QAM we can
put in six bits per symbol. This for example is used in DVB-T or DAB like
broadcasting systems or in Wi-Fi 802.11n uses up to 64-QAM. LTE also uses up to
64-QAM. When we go for father 802.11ac uses 256-QAM, so even more dots. You can
put in eight bits then per symbol and so does LTE Advanced and so the more data you
want to transmit, the more symbols you need. 802.11ax uses up to ten 1024-QAM
with 10 bits per symbol. And so does successor of 4G like the 5G New Radio also
uses up to 1024-QAM. Becomes interesting when we add some noise.
So you always, as I told you, always got the channel you always got noise. This is
what happens if we add some noise to the 64-QAM. You could still like estimate
where the original symbol would be. This becomes even more difficult if we go to
the 1024-QAM. That's also why those broadband systems always use an adaptive
modulation like within the first data exchange they communicate about the
quality of the signal and only if you get a really good signal level at the
receiver, you choose the highest order modulation. Otherwise it ramped down to
lower orders. So these high order modulations only work with really good
signal levels. So let's go back to the IQ data. Those IQ data are closely related to
complex numbers. So to get the complex number let's add some imaginary unit j. So
we get our complex number actually a C = I + j * Q which are again our inphase and
quadrature component. So a complex number you can write them in
the Cartesian form which I showed. The mostly often used form is
actually the polar form where are we add Euler's number. So it becomes like C quals
a multiplied by e, Euler's number, to the power of j * phi which is our phase here
again. So in this case like our real axis, the inphase axis here becomes our real
axis and the Q axis becomes our imaginary axis. This property of this polar form,
which is often needed in digital signal processing, is the multiplication. Like if
you multiply two polar formed complex numbers this ends up in an addition of the
elevated parts here. And this is often used for example in Fourier
transformations or if you mix signals to get them from one frequency to the other.
One this later it looks quite complex but it's really worth using it at the end.
So um the first step in the software defined radio is then to get the right
parts of the signal through the front end, because if you don't get your IQ data
actually properly, afterwards decoding in software becomes very very difficult or
even impossible. So let's have a look at the different parts of our software
defined receiver. After the antenna, filtering and amplifier, we have this IQ
mixer. To keep it a bit more simple for now we just skip the IQ part and have a
look what a mixer in general is doing. To get the signal from the transmitted
frequency to the IF, to the intermediate frequency, it is multiplied with an LO
signal and then filtered. This multiplication actually ends up here in an
addition. Here this higher part and in a subtraction of the two frequencies we put
in here. And with the filter we actually get rid of of the higher part here. The
mixer defines the frequency range the SDL front end is working on. For example there
are those quite cheap RTL SDR USB sticks which were originally made for DVB-T
reception. They work for example from 24 megahertz up to 1766 megahertz.
Then there's the HackRF, which is also an often used SDR font end, works from 1 MHz
up to 6 GHz. And the radio badge from the CCC camp 2015 works from 50 MHz up to 4
GHz. As I told, the mixer here is a bit simplified. Here is for example the the
mixer chipset of the HackRF. Here you can see the IQ mixing part here.
Next step then, after again some filtering amplification is the analog to digital
converter. We get the analog signal in here. And what the computer actually needs
are samples of the signal. So they have to be taken at dedicated times t here. We get
the sampling rate here: 1 divided by T. This sampling rate must comply with the
Nyquist Shannon sampling theorem. Otherwise your signal can't be
reconstructed properly. You get effects like aliasing where you have frequencies
that actually are not there, but are caused by the undersampling of the signal
and for complying this Nyquist Shannon theorem, like the the bandwidth of your
signal, of the signal you want to digitize, has to be smaller than one
divided by 2*T. Here an example of an DAB+ signal. DAB+ is nice because it always has
a bandwidth of 1.5 MHz, it has quite sharp edges because it uses an OFDM modulation.
This here was received with an RTL SDR DAB/DVB-T stick, with the software Gqrx
which has a maximum sampling rate of 3.2 MHz. So let's check for Nyquist. We have
our bandwidth of 1.5 MHz, we have the sampling rate of 3.2 MHz. So 1 divided by
2*T is 1.6 MHz and 1.5 MHz is smaller than 1.6 MHz. Great! We can receive a DAB+
signal with a DAB receiver. You might ask now, this is also for the DVB-T reception
which has a bandwidth of 8 MHz. So you would need a sampling rate of 60 MHz to
receive or to digitize this. That's actually a nice example of the usage of
SDR in comparison to dedicated chipsets. So DVB-T here doesn't use the SDR mode of
this chipset, but it has a dedicated DVB-T chipset in here. So chipset development is
quite expensive, but if there is a mass market and for television there is a mass
market, they can be produced very cheap. So actually the SDR mode was probably
added for the DAB reception. Also with the growing bandwidth the power consumption of
the SDR mode becomes quite high, because you have always to digitize the whole
bandwidth of your signal. So if it comes for example to LTE with 20
or 40 MHz bandwidth this becomes quite relevant. OK, we can get the DAB signal
here. The next relevant parameter here is the
resolution of the ADC. With a 3 bit resolution for example you would get 8
discrete values from your signal. With an 8 bit resolution you get 256 values. With
60 bit you get a lot of values and those parts of the step here, you can see for
example the 3 bit resolution and the 6 bit resolution of a sine signal and all those
parts of the steps, of the 3 bit resolution, actually end up in noise,
which is called quantization noise. Here for example you see the spectral view
of the signal. The first one with a 6 bit resolution. You can see the noise floor
here at -68 dB and below with the 8 bit resolution, the noise floor falls down by
12 dB. So we get a noise floor down at -80 dB. What we also see here is actually here
are some examples. The RTL SDR has two 8 bit ADCs, the HackRF and the Rad1o have a
dual 8 bit receive ADCs and, as they are also transmitting purposes, they have a
dual 10 bit transmit DAC, so the other way round to get your digital signal in the
analog domain again. The RTL SDR is only for receiving purposes.
What we also see here is on the right side, we get our signal in the time
domain, on the left side we get the frequency domain. So how do we get the
frequency view of our signal? Here for example in the form of a spectral view and
down here is this with a nice colors, this part is called a waterfall diagram. Here
in the spectrum view we see the level of our signal components over the frequency
and the waterfall diagram then shows the different levels and different colors
plotted over the time here. So how do we get the frequency view of our
signal? Actually uh we use a Fourier transformation to convert the time the
main signal into the frequency domain. Wikipedia actually had a nice animation
about this in public domain, so we have a square wave signal which is a linear
combination of sines of different frequencies here in blue. And the
component frequencies of these sines then are spread across the frequency spectrum
and they are represented here as peaks in the frequency domain.
So mathematically this looks like this: here we get the different components, the
sine components of our square wave signal. For the sake of simplicity, we just skip
the harmonics here, just take the sine signal, calculate the Fourier
transformation which is an integral of our function. The sine signal here multiplied
by e^(-j*2*pi*f*t) and integrated over t. We also use again the polar form here,
which then ends up in a multiplication of these components and the integral of this
multiplication then ends up in delta impulses at a frequency here of a and -a
and we still have half of an inverse imaginary unit here.
If we have a look at the Fourier transform of a complex constant wave signal, this
actually simplifies to 1 delta impulse here at the frequency of a. For practical
purposes um computational purposes we use a DFT, like a discrete Fourier
transformation, so the integral ends up in a summation of the signal components. And
actually normally we use a fast Fourier transformation which you also see in all
the software, which is actually an algorithm to efficiently calculate a DFT.
So let's have a view again at the DAB signal here with the Gqrx software. We
have the waterfall view and because it's a bit small, no here it's actually quite
seen. Yeah it's a bit bigger. So on the left side we have an FFT size of 32768 and
on the right side an FFT size of 512 and actually with the FFT length you define
afterwards the resolution of the bandwidth of the spectrum. So you can see here, it's
much more coarser than with a higher radio resolution bandwidth here on the left
side. Then the sliders down here, you can find
those sliders and stuff here in the FTT settings of Gqrx if you want to have a
look at this software. The sliders here down, I also have them a bit bigger here
you can define the reference level. So if you have a very low signal, you have to
put it a bit down. And also the, range like the range you see your signal. If you
have a high dynamic signal, you need a large range to see all the parts of the
signal. If you have a very very low signal power you need to switch it down to a
smaller range to actually see anything of your signal.
So the possibility is actually to efficiently calculate an FFT or IFFT, like
the inverse Fourier transformation, also gave the possibility to a wider use of
multi carrier modulation methods as OFDM here, orthogonal frequency division
multiplex. Nowadays this is often used in mobile
communication systems such as LTE due to its resistance to the effects of the
propagation channel. For example multi- path propagation um often causes
destructive interferences so some of your carriers actually are in an destructive
interference part, so they are actually attenuated a lot.
And if you if you distribute your information over several carriers, you
still have the chance to receive some of the carriers and then you can afterwards
use some error correction mechanisms to repair actually the data and get something
out of the data. And so here the FFT or in the TX case, in the the transmission case,
an inverse FFT is used actually to distribute the, for example the QAM data
to the different frequencies to the different carriers. Then it's again the
regular IQ mixer and in the case of the reception we use the FFT to get the
symbols, the QAM symbols for example, out of our different carriers. Here again you
see I like DAB, again the DAB signal. Here we have a DAB uses 1536 subcarriers and
the number of subcarriers here actually is also always a compromise of how close your
subcarriers are, which defines how much Doppler shifts, in case of mobile
reception, your system is capable to scope with and on the other hand it defines how
long your signal is in the air. So the more carrier you have the longer your
signal is and that has an effect on how much delay your signal can scope with.
Additionall, often there is a guard interval added to the symbol to scope with
more delays, for example DAB is a broadcasting system with a capability of
single frequency networks, so you can run different transmitters on the same
frequency with the same program but especially in the overlapping areas this
results in very large delays So that's why the broadcasting system has very much
carriers. LTE in contrast only has in the downlink with a 10 MHz bandwidth 601
carriers, in the uplink 600. And 802.11ac for example with 40 MHz bandwidth has 128
carriers. So now let's come back from this quite
complex world of software defined radio to the real world. So what SDR actually
brings are quite cheap and flexible solutions of formerly very expensive
technology. That's why it's actually often used in academia are also for prototyping
purposes. But there's also a quite big community developing open source software
for software defined radio. I want to show you now like two examples where those SDR
technologies facilitated community driven projects. One is digital radio which goes
digital in Switzerland or Community Radio goes digital In Switzerland. Like
digitizing local community radio has actually long been a problem, community
radios are a non-profit making media produced by a local community and serving
a local community. There's also one here in Leipzig which are
also doing a program from the Congress here. I think they are actually starting
now for I think for 3 hours today. It's called Fairydust.FM, so if you want to
listen you can look at the wiki where to receive them. They mostly do not have a
huge budget for running a radio. The development was facilitated by a low
threshold cheap transmitter. So FM transmitters are really cheap now or they
can be built. With DAB now, digital audio broadcast, the possibilities of running
your own cheap transmitter became quite difficult for a long long time. DAB was
developed by the big broadcasting corporations like BBC or the German public
media. And it's actually adapted to their needs.
You can put in a lot of programs in multiplexes, you can run huge single
frequency networks. There is a national SFN in Germany for example. Local
community radios, so does local commercial radios, need more like flexible cheap
radio transmission. So you might argue that digital radio isn't relevant anymore
but actually there are countries that start to switch off FM and only streaming
through the Internet is also not an appropriate solution. So what happened
some years ago was, that people started to write open source DAB SDR software to
build up quite cheap DAB transmitters. You can find the software here on
opendigitalradio.org. They have this nice penguin with a transmission tower as a
logo and in Switzerland the FM switch-off is set to 2024. So it's quite coming
closer and a lot of communities are already on the digital airwaves there with
this solution of software defined radio based transmitter technologies.
The UK is also on the way to switch off FM and there the Ofcom actually recently
started a survey about the demand for small scale DAB. Also based on this SDR
solution which makes it affordable to community radios. Another example is
community-driven cellular telephone telephony. In remote areas, for example in
Mexico and probably in a lot of more countries, often there is no cellular
network connection at all as it's just not a good business for mobile broadband
providers if you have only a few hundred clients to use it or customers who pay for
it. I was some years ago in the south of Mexico for an article about the first
community driven cellular network which was also built on open source SDR
technology like OpenBSC and OpenBTS which made it then quite affordable for the
communities there. Today this "association telecommunications *inaudible* comunitarias" has
a license to run autonomous telephone networks in different parts of Mexico as
Chapels (*inaudible* Mexican region), Vera Cruz and Puebla and nowadays they are already
running nearly 20 cellular networks there and they also do a lot of trainings and
write a lot of manuals. So if you want to learn how to run your own GSM networks,
they are actually only, you can have a look on their site. So these are only two
examples of projects where SDR facilitated low budget communication, so you might
ask, if you now want to have a look on SDR yourself, where to start. So for radio
reception this cheap RTL SDR USB sticks are your friend.
They cost around 10 to 20 euros depending on where you get it. And there's software
like this Gqrx, which I already had a lot of examples in my slides, which runs on
Linux and Mac. Here's an example of Gqrx for FM reception for example. It has also
an built-in FM decoder, so you can really listen to FM radio. There are also AM
decoder and some others also. You can also dump the IQ data with this Gqrx for
decoding it later. There's also software for Windows like SDR# or HSDR or WinSDR.
Always keep in mind that listening to non- public broadcasts is forbidden! The next
level then would be GNURadio, I already showed in between the talk plots from
GNURadio, like the constellation plots of QAM modulation. GNURadio actually offers a
very large framework for software defined radio functions. Also to build your own
applications. There are sources. For example here is a source where you can
connect your RTL SDR USB stick, define here the sampling rate, the frequency and
different and other stuff here. Then you have a lot of function here, for example
the FM demodulation, you have a spectrum viewer, here the FFT sink, different
resamplers and then you have different sinks here. You you connect it to your
sound card with the audio sink and in this case listen to FM radio. You can also
define a sink to connect your HackRF to transmit something. You can also write
your own functions. So it's quite easy in this graphical front, the GNU Radio
Companion to add own functions. There are many tutorials also in the
Internet and very active community and it's also very often used in academia. So
if you are perhaps studying or are planning to study, there are very often
projects around GNURadio which you can work on if you're interested. There is
also a lot of different SDR hardware available. So the HackRF I already
mentioned, the Rad1o badge from the CCC camp. So if you don't have one, you can
ask around perhaps someone still have one lying around. There are more expensive
ones, which then have for example better resolutions, the ADCs, DACs have better
resolutions. Um there is the USRP family which is much
more expensive but, yeah you can do a lot more with this and it's also very often
used in academia. I also knew it from my time I worked at the university. So
further information, if you are now becoming really interesting, there are
lots of massive open online courses. For example I saw one from the University of
Madrid but in English. So there are video tutorials for example from the makers of
the HackRF at their website. There also nice, free available books on SDR by
Analog Devices for example, if you look for "SDR4 engineers". And if you are now
here, there is an SDR challenge at the congress. They have a table in Hall 3 in
the wastelands there. If we have a look at the small brand(???) so there are various
different SDR challenges from quite easy to difficult. There's a game server to
claim your flag in a team and if you don't have an SDR you can borrow one, like these
RTLS SDR sticks, for a deposit and there also if you don't like all this GNURadio
stuff, there are also Bluetooth challenges. So thanks for your attention.
And feel free to ask questions if you want!
*Applause*
Herald: Thank you. We have at least 15
minutes left for Q and A. So walk to a microphone and let's see what you got
questionwise. OK, microphone number five. Question: Yeah. You mentioned that
listening to a non-public broadcast is forbidden. What's your basis for this.
Because if I recall correctly the European Convention of Human Rights has an article
about being free to conduct journalism. And there was a claim that journalism
includes just listening to the entire FM spectrum.
Answer: Yeah. The FM spectrum is public so there's no problem. But there are other
services like that are not encrypted because in former times this technology
just wasn't available or affordable for normal persons. So nowadays you have much
more possibilities to receive other frequencies for example quite easily which
are not public. And so it's forbidden to listen to them actually.
Q: Yeah but by what? Is there a law? A: The law? Oh I'm not a lawyer so I don't
know exactly what law it is. Q: Okay.
H: Okay, any other questions? Does the Internet have questions by now? If you
have a question by the way just go to a microphone.
Signal: The Internet doesn't have any questions but MCR of open digital radio
would like to thank you for speaking with them.
H: OK. That's not a question. A: Sorry, what? I didn't get it.
S: No questions. A: Okay. Okay great.
H: Well that's a quick one then. Thank you all for your attention. Oh sorry.
Microphone number two. Q: Yeah. It's not a question either. It's
just a clarification of the legal situation. So basically you're allowed to
listen to non-public broadcasts or non- public radio traffic for example like a
aero nautical. But you're not allowed to record it and to to publish the
information that you gathered. A: Ah OK, thanks.
Q: So, theoretically sitting at home and listening to, yeah, I mean the tower
talking to the pilots or whatever or even to to police is allowed. You're just not
allowed to basically make a profit from it. That's the legal situation in Germany.
I don't know how it looks in other parts of Europe.
H: Since we are violating the protocol of Q and A anyway by not asking questions.
*Laughter* H: I am a lawyer and various member states
of member state you could question that as attention if the European Convention of
Human Rights or not. But it really varies from member state to member state.
*Laughter* Q: Well, in that case.
*Applause* Herald: Now I really would like to have a
genuine question. Something that starts with a sentence, ends with a question
mark. Do we have any takers? Oh in that case, thank you so much for your
attention.
*35c3 postroll music*
subtitles created by c3subtitles.de in the year 2019. Join, and help us!