The Global System for Mobile (GSM) cellular standard, having been in existence for over two decades, is the most widely deployed wireless technology in the world. While third generation networks and beyond, such as Universal Mobile Telecommunications System (UMTS) and Long Term Evolution (LTE), are undergoing extraordinary growth and driving a large share of current cellular development, technologies and deployments based on GSM are still dominant on a global scale and, like more recent standards, continue to evolve very rapidly. The software-defined radio (SDR) base station is one technology that is driving rapid change in cellular infrastructure. While commercial vendors have now embraced SDR, there is another movement that has recently gained prominence. That movement is the convergence of open source software and hardware with cellular implementation. OpenBTS, a deployable implementation of the GSM radio air interface, and the Universal Software Radio Peripheral (USRP), a RF hardware platform, are two primary examples of such open source software and hardware products. OpenBTS and the USRP underlie three GSM features that are implemented and presented in this thesis. This thesis describes the extension of the OpenBTS software-defined radio transceiver in the three critical areas of user capacity, transmit signal integrity, and the embedded small form factor. First, an optimized wideband multicarrier implementation is presented that substantially increases the capacity beyond that of a single carrier system. Second, the GSM modulator is examined in depth and extended to provide performance that exceeds standards compliance by a significant margin. Third, operation of the GSM transceiver on an E100 embedded platform with ARM and fixed point DSP processors will be explored, optimized, and tested. / Master of Science

The advent of software radio technology has enabled radio developers to design and implement radios with great ease and flexibility. Software radios are effective in experimentation and development of radio designs. However, they have limitations when it comes to high-speed, high-throughput designs. This limitation can be overcome by introducing a hardware element to the software radio platform. Enhancing GNU Radio for Hardware Accelerated Radio Design project implements such a scheme by augmenting an FPGA co-processor to a conventional GNU Radio flow. In this thesis, this novel platform is evaluated in terms of performance of a radio design, as well as hardware and software system requirements. A simple and efficient Zigbee receiver design is presented. Implementation of this receiver is used as a proof-of-concept for the effectiveness and design methodology of the modified GNU Radio. This work also proposes a scheme to extend this idea for design of ultra-wideband radio systems based on multiband-OFDM. / Master of Science

Massive deployment of diverse ultra-low power wireless devices necessitates the rapid development of communication protocols. Software Defined Radio (SDR) provides a flexible platform for deploying and evaluating real-world performance of these protocols. But SDR platform based communication systems suffer from high and unpredictable delays. There is a lack of comprehensive understanding of the characteristics of the delays experienced by these systems for new SDR platforms like LimeSDR. This knowledge gap needs to be filled in order to reduce these delays and better design protocols which can take advantage of these platforms. We design a GNU Radio based IEEE 802.15.4 experimental setup, where the data path is time-stamped at various points of interest to get a comprehensive understanding of the characteristics of the delays. Our analysis shows GNU Radio processing and LimeSDR buffering delay are the major delays in these data paths. We try to decrease the LimeSDR buffering delay by decreasing the USB transfer size but it comes at the cost of increased processing overhead. The USB transfer packet size is modified to investigate which USB transfer size provides the best balance between buffering delay and the processing overhead across two different host computers. Our experiments show that for the best-measured configuration the mean and jitter of latency decreases by 37% and 40% respectively for the host computer with higher processing resources. We also show that the throughput is not affected by these modifications. Higher processing resources help in handling higher processing overhead and can better reduce the buffering delay. / Stora installationer av heterogena extremt energisnåla trådlösa enheter ställer krav på snabb utveckling av kommunikationsprotokoll. Mjukvarubaserad radio (Software Defined Radio, SDR) tillhandahåller en flexibel plattform för att installera och utvärdera faktisk prestanda för dessa protokoll. Men SDR-baserade system har problem med stora och oförutsägbara fördröjningar. Verklig förståelse av hur dessa fördröjningar beter sig i nya plattform som LimeSDR saknas. Dessa kunskapsbrister behöver överbryggas för att kunna minska fördröjningarna och för att mer framgångsrikt kunna designa protokoll som drar nytta av de nya plattformarna. Vi skapar en försöksuppställning för IEEE 802.15.4 baserad på GNU Radio. Data som passerar systemet tidsstämplas för att ge underlag till att förstå fördröjningarnas egenskaper. Vår analys visar att fördröjningarna främst kommer från processande i GNU-radion och buffertider för LimeSDR. Vi försöker minska buffertiderna för LimeSDR genom att minska paketstorleken för USB-överföring, men det kommer till priset av ökade bearbetningskostnader. Paketstorleken för USB-överföring modifieras för att på två olika testdatorer undersöka den bästa balansen mellan buffertider och bearbetningskostnader. Våra experiment visar att för att den mest noggrant undersökta försöksuppställningen så minskar medelvärdet och jittret för fördröjningarna med 37% och 40% för testdatorn med mest beräkningskraft. Vi visar också att genomströmningen inte påverkas av dessa ändringar. Med mer beräkningskraft kan de ökade bearbetningskostnader hanteras, och buffertiderna kan förkortas mer effektivt.

In modern society, Global Navigation Satellite Systems (GNSSs) are ubiquitously relied upon by many systems, among others in critical infrastructure, for navigation and time synchronization. To overcome the prevailing vulnerable state of civilian GNSSs, many detection schemes for different attack types (i.e., jamming and spoofing) have been proposed in literature over the last decades. With the launch of Galileo Open Service Navigation Message Authentication (OS­NMA), certain, but not all, types of GNSS spoofing are prevented. We therefore analyze the remaining attack surface of relay/replay attacks in order to identify a suitable and effective combination of detection schemes against these. One shortcoming in the evaluation of countermeasures is the lack of available test platforms, commonly limiting evaluation to mathematical description, simulation and/or test against a well defined set of recorded spoofing incidents. In order to allow researchers to test countermeasures against more diverse threats, this degree project investigates relay/replay attacks against GNSS signals in real­world setups. For this, we consider colluding adversaries, relaying/replaying on signal­ and on message­level in real­time, over consumer grade Internet, and with Commercially off the Shelf (COTS) hardware. We thereby highlight how effective and simple relay/replay attacks can be on existent and likely on upcoming authenticated signals. We investigate the requirements for such colluding attacks and present their limitations and impact, as well as highlight possible detection points. / Det moderna samhället förlitar sig på ständigt tillgängliga satellitnavigeringssystem (GNSSs) för navigering och tidssynkronisering i bland annat kritisk infrastruktur. För att åtgärda det rådande såbara tillståndet i civila GNSSs har många detektionssystem för olika attacktyper (dvs. jamming och förfalskning) blivit förslagna i den vetenskapliga litteraturen under de senaste årtiondena. Införandet av Galileo Open Service Navigation Message Authentication (OS NMA) förhindrar vissa, men inte alla typer av förfalskningsattacker. Därför analyserar vi den övriga angreppsytan för replay attacker för att identifiera en kvalificerad och effektiv kombination av detektionssystem emot dem. Ett tillkortakommande i utvärdering av detektionssystemen är bristen på tillgängliga testplattformar, vilket får konsekvensen att utvärderingen ofta är begränsad till matematiska beskrivningar, simuleringar, och/eller testning mot ett väldefinierat set av genererad förfalskningsattacker. För att hjälpa forskarna testa detektionssystemen mot mer varierade angrepp undersöker detta examensarbete replay attacker mot GNSS signaler i realistiska situationer. För dessa syften betraktar vi kollaborerande angripare som utför replay attacker på signal ­ och meddelandennivå i realtid över konsument­kvalité Internet med vanlig hårdvara. Vi framhäver därmed hur effektiva och enkla replay attacker kan vara mot befintliga och kommande autentiserade signaler. Vi undersöker förutsättningar för sådana kollaborerande attacker och presenterar deras begränsningar och verkan, samt möjliga kännetecken.

Thesis (PhD (Electrical and Electronic Engineering))--University of Stellenbosch, 2011. / ENGLISH ABSTRACT: The use of the quadrature mixing topology has been severely limited in the past due to its sensitivity towards mismatches between its signal paths. In recent years, researchers have suggested that digital techniques can be used to compensate for the impairments in the analogue quadrature mixing front-end. Most authors, however, focus on the modelling and compensation of frequency-independent imbalances, reasoning that this approach is sufficient for narrow band signal operation. This common assumption is, however, becoming increasing less applicable as the use of wider bandwidth signals and multi-channel systems becomes more prevalent. In this dissertation, baseband equivalent distortion models are derived, which model frequency-independent, as well as frequency-dependent contributions towards the imbalances of the front-end. Both lowpass and bandpass imbalances are modelled, which extends current modelling approaches found in literature. The resulting baseband models are shown to be capable of explaining the imbalance characteristics observed in practical quadrature mixing front ends, where existing models fail to do so. The developed imbalance models is then used to develop novel frequency-dependent imbalance extraction and compensation techniques, which directly extract the exact quadrature imbalances of the front end, using simple test tones. The imbalance extraction and compensation procedures are implemented in the digital baseband domain of the transceiver and do not require high computational complexity. The performance of these techniques are subsequently verified through simulations and a practical hardware implementation, yielding significant improvement in the image rejection capabilities of the quadrature mixing transceiver. Finally, a novel, blind imbalance compensation technique is developed. This technique is aimed at extracting frequency-independent I/Q imbalances in systems employing digital modulation schemes. No test tones are employed and the imbalances of the modulator and demodulator are extracted from the second order statistics of the received signal. Simulations are presented to investigate the performance of these techniques under various operating conditions. / AFRIKAANSE OPSOMMING: Die gebruik van die haaksfasige mengtopologie word geweldig beperk deur die sensitiwiteit vir wanbalanse wat mag bestaan tussen die twee analoog seinpaaie. In die afgelope paar jaar het navorsers digitale metodes begin voorstel om te kompenseer vir hierdie wanbalanse in die analooggebied. Meeste navorsers fokus egter op frekwensie-onafhanklike wanbalanse. Hulle staaf hierdie aanslag deur te redineer dat dit ’n aanvaarbare aaname is vir ’n nouband stelsel. Hierdie algemene aanvaarding is egter besig om minder akkuraat te raak, namate wyeband- en multikanaalstelses aan die orde van die dag raak. In hierdie tesis word basisband-ekwiwalente wanbelansmodelle afgelei wat poog om die effek van frekwensie-afhanklike en -onafhanklike wanbalanse akkuraat voor te stel. Beide laagdeurlaat- en banddeurlaatwanbalanse word gemodelleer, wat ‘n uitbreiding is op die huididge modellerings benaderings wat in literatuur gevind word. Dit word aangetoon dat die modelle van hierdie tesis daarin slaag om die karakteristieke van ’n werklike haaksfasige mengstelsel akkuraat te vervat – iets waarin huidige modelle in die literatuur nie slaag nie. Die basisband-ekwiwalente modelle word dan gebruik om nuwe digitale kompensasie metodes te ontwikkel, wat daarin slaag om die frekwensie-afhanklike wanbalanse van die haaksfasige mengstelsel af te skat, en daarvoor te kompenseer in die digitale deel van die stelsel. Hierdie kompensasiemetodes gebruik eenvoudige toetsseine om die wanbalanse af te skat. Die werksverrigting van hiedie kompensasiemetodes word dan ondersoek deur middel van simulasies en ’n praktiese hardeware-implementasie. Die resultate wys daarop dat hierdie metodes daarin slaag om ’n aansienlike verbetering in die beeldonderdrukkingsvermo¨ens van die haaksfasige mengers te weeg te bring. Laastens word daar ook ’n blinde kompensasiemetode ontwikkel, wat gemik is op frekwensie- onafhanklike wanbalanse in digital-modulasie-skama stelsels. Vir hierdie metodes is geen toetsseine nodig om die wanbalanse af te skat nie, en word dit gedoen vanuit die tweede-orde statistiek van die ontvangde sein. Die werksverrigting van hierdie tegnieke word verder bevestig deur middel van simulasies.

Em 1997, o conceito de rádio cognitivo foi proposto pela primeira vez e evoluiu significativamente até os dias de hoje, como solução para o problema da escassez de espectro eletromagnético. Nessa proposta, usuários oportunistas, através de acesso dinâmico ao espectro, fazem uso das faixas de frequências atribuídas a usuários licenciados, quando eles não as estão utilizando. Para que isso seja possível, sem interferir ou degradar os sinais dos usuários licenciados, é necessário atender a quatro requisitos essenciais de rádios cognitivos: Sensoriamento espectral, Decisão do espectro, Compartilhamento do espectro e Mobilidade espectral. Neste trabalho, o sensoriamento espectral é investigado com base na detecção de energia. Um algoritmo é desenvolvido para se determinar o número de canais ocupados e o número de amostras necessárias na detecção para se atingir probabilidades de detecção e falso alarme pré-estabelecidas. Resultados de simulações são apresentadas mostrando que a incerteza do ruído degrada o desempenho do sistema quando a relação sinal-ruído é baixa. O algoritmo desenvolvido permite também determinar o limite inferior para a relação sinal-ruído, quando há incerteza do ruído. O comportamento da probabilidade de detecção em função da probabilidade de falso alarme parametrizado para número de amostras e relação sinal-ruído é apresentado. As curvas resultantes são muitas vezes referidas como curvas ROC - Receiver Operation Characteristics na literatura. Em função do grande interesse sócio-político pela banda de TV, que o cenário das telecomunicações atualmente apresenta, a mesma foi escolhida para alguns exemplos deste estudo. / In 1997, the concept of cognitive radio was proposed for the first time and evolved significantly to the present days, as a solution to the problem of electromagnetic spectrum scarcity. In the proposed approach, opportunistic users utilize frequency bands originally assigned to licensed users through dynamic spectrum access when the licensed users are not using them. To make this possible, without interfering or degrading the signals from the licensed users, it is necessary to fulfill four essential requirements of cognitive radios: spectrum sensing, spectrum decision, spectrum sharing, and spectrum mobility. In this work, spectrum sensing based on energy detection was investigated. An algorithm was developed for the determination of channel occupation and the number of samples needed for the detection process to achieve pre-established probabilities of detection and false-alarm. Simulations results are presented showing that noise uncertainty degrade the performance of the system when the signal-to-noise ratio is low. The developed algorithm allows determining a lower threshold for the signal-to-noise ratio, when noise uncertainty exists. The detection probability behavior as a function of the false alarm probability having the number of samples and the signal-to noise ratio as parameters is presented. The resulting curves are often denominated ROC - Receiver Operation Characteristics in the literature. Due to the high social and political interest in the TV broadcasting band, that telecommunications scenario currently presents, this band was chosen for same examples in this study.

La radio logicielle est une technologie prometteuse pour répondre aux exigences de flexibilité des nouvelles générations de standards de communication. Elle peut être facilement reprogrammée au niveau logiciel pour implémenter différentes formes d'onde. En s'appuyant sur une technologie dite logicielle telle que les microprocesseurs, cette approche est particulièrement flexible et assez facile à mettre en œuvre. Cependant, ce type de technologie conduit généralement à une faible capacité de calcul et, par conséquent, à des débit faibles. Pour résoudre ce problème, la technologie FPGA s'avère être une bonne alternative pour la mise en œuvre de la radio logicielle. En effet, les FPGAs offrent une puissance de calcul élevée et peuvent être reconfigurés. Ainsi, inclure des FPGAs dans le concept de radio logicielle peut permettre de prendre en charge plus de formes d'onde avec des exigences plus strictes qu'une approche basée sur la technologie logicielle. Cependant, les principaux inconvénients d’une conception à base de FPGAs sont le niveau du langage de description d'entrée qui doit typiquement être le niveau matériel, et le temps de reconfiguration qui peut dépasser les exigences d'exécution si le FPGA est entièrement reconfiguré. Pour surmonter ces problèmes, cette thèse propose une méthodologie de conception qui exploite à la fois la synthèse de haut niveau et la reconfiguration dynamique. La méthodologie proposée donne un cadre pour construire une radio flexible pour la radio logicielle à base de FPGAs et qui peut être reconfigurée pendant l'exécution. / Software defined radio (SDR) is a promising technology to tackle flexibility requirements of new generations of communication standards. It can be easily reprogrammed at a software level to implement different waveforms. When relying on a software-based technology such as microprocessors, this approach is clearly flexible and quite easy to design. However, it usually provides low computing capability and therefore low throughput performance. To tackle this issue, FPGA technology turns out to be a good alternative for implementing SDRs. Indeed, FPGAs have both high computing power and reconfiguration capacity. Thus, including FPGAs into the SDR concept may allow to support more waveforms with more strict requirements than a processor-based approach. However, main drawbacks of FPGA design are the level of the input description language that basically needs to be the hardware level, and, the reconfiguration time that may exceed run-time requirements if the complete FPGA is reconfigured. To overcome these issues, this PhD thesis proposes a design methodology that leverages both high-level synthesis tools and dynamic reconfiguration. The proposed methodology is a guideline to completely build a flexible radio for FPGA-based SDR, which can be reconfigured at run-time.

Em 1997, o conceito de rádio cognitivo foi proposto pela primeira vez e evoluiu significativamente até os dias de hoje, como solução para o problema da escassez de espectro eletromagnético. Nessa proposta, usuários oportunistas, através de acesso dinâmico ao espectro, fazem uso das faixas de frequências atribuídas a usuários licenciados, quando eles não as estão utilizando. Para que isso seja possível, sem interferir ou degradar os sinais dos usuários licenciados, é necessário atender a quatro requisitos essenciais de rádios cognitivos: Sensoriamento espectral, Decisão do espectro, Compartilhamento do espectro e Mobilidade espectral. Neste trabalho, o sensoriamento espectral é investigado com base na detecção de energia. Um algoritmo é desenvolvido para se determinar o número de canais ocupados e o número de amostras necessárias na detecção para se atingir probabilidades de detecção e falso alarme pré-estabelecidas. Resultados de simulações são apresentadas mostrando que a incerteza do ruído degrada o desempenho do sistema quando a relação sinal-ruído é baixa. O algoritmo desenvolvido permite também determinar o limite inferior para a relação sinal-ruído, quando há incerteza do ruído. O comportamento da probabilidade de detecção em função da probabilidade de falso alarme parametrizado para número de amostras e relação sinal-ruído é apresentado. As curvas resultantes são muitas vezes referidas como curvas ROC - Receiver Operation Characteristics na literatura. Em função do grande interesse sócio-político pela banda de TV, que o cenário das telecomunicações atualmente apresenta, a mesma foi escolhida para alguns exemplos deste estudo. / In 1997, the concept of cognitive radio was proposed for the first time and evolved significantly to the present days, as a solution to the problem of electromagnetic spectrum scarcity. In the proposed approach, opportunistic users utilize frequency bands originally assigned to licensed users through dynamic spectrum access when the licensed users are not using them. To make this possible, without interfering or degrading the signals from the licensed users, it is necessary to fulfill four essential requirements of cognitive radios: spectrum sensing, spectrum decision, spectrum sharing, and spectrum mobility. In this work, spectrum sensing based on energy detection was investigated. An algorithm was developed for the determination of channel occupation and the number of samples needed for the detection process to achieve pre-established probabilities of detection and false-alarm. Simulations results are presented showing that noise uncertainty degrade the performance of the system when the signal-to-noise ratio is low. The developed algorithm allows determining a lower threshold for the signal-to-noise ratio, when noise uncertainty exists. The detection probability behavior as a function of the false alarm probability having the number of samples and the signal-to noise ratio as parameters is presented. The resulting curves are often denominated ROC - Receiver Operation Characteristics in the literature. Due to the high social and political interest in the TV broadcasting band, that telecommunications scenario currently presents, this band was chosen for same examples in this study.

This diploma thesis focuses on the design and implementation of an emulator of RFID protocols in a software defined radio. The designed emulator operates in the UHF band (860 MHz – 960 MHz). The main goal of this design is a very fast measurement of power characteristic of tag. The proposed solution is based on implementing the transmitter controls directly into the SDR. Thanks to this solution a reduction of delay between measurements occur compared to the conventional concept, when the transmitter parameters are controlled by the hosted PC. In this thesis, suitable platform based on research is chosen for implementation and also a concept of design is proposed and described herein, which is based on implementation of time critical algorithms directlyinto the software defined radio’s FPGA. The proposed solution was implemented into selected platforms and its functionality was experimentally verified.

Processing power is a key technical challenge holding back the development of a high-performance software defined radio (SDR). Traditionally, SDR has utilized digital signal processors (DSPs), but increasingly complex algorithms, higher data rates, and multi-tasking needs have exceed the processing capabilities of modern DSPs. Reconfigurable computers, such as field-programmable gate arrays (FPGAs), are popular alternatives because of their performance gains over software for streaming data applications like SDR. However, FPGAs have not yet realized the ideal SDR because architectures have not fully utilized their partial reconfiguration (PR) capabilities to bring needed flexibility. A reconfigurable processor architecture is proposed that utilizes PR in reconfigurable computers to achieve a more sophisticated SDR. The proposed processor contains run-time swappable blocks whose parameters and interconnects are programmable. The architecture is analyzed for performance and flexibility and compared with available alternate technologies. For a sample QPSK algorithm, hardware performance gains of at least 44x are seen over modern desktop processors and DSPs while most of their flexibility and extensibility is maintained.