Resources Video

Radio Theory Basics

 

Summary

Dr. Bob Baxley, Chief Scientist at Bastille Networks discusses “Radio Theory Basics”

Video Transcript

- Hi, welcome to this talk on Radio Theory Basics. My name's Bob Baxley, and I'm the Chief Engineer at Bastille where I run the radio and data science teams. In this talk I want to give you a feeling for how software defined radios work and then how their predecessor hardware defined radios work.

To kick that off, I've got a picture here of the internals of a Wink hub, which is a kind of a home LIT hub that's made to be able to interface and talk to all these wireless peripherals. So there's wireless devices Bluetooth, Wifi, Z Wave, Kiddie, Lutron, Zigbee.

There's all these different standards. And this device can talk to them all. And the way that it does that as I've annotated on this diagram is that it actually discretes circuits for each one of these protocols. And in those circuits, there's a discrete chip that operates at exactly that frequency and speaks exactly that protocol.

This is a somewhat cumbersome way to have an IOT hub that talks to a bunch of things. But, for now, it's the most cost-effective way to do it. What it displays though, is kind of the lack of flexibility in most of these RF chips. If I want to speak multiple protocols I need multiple pieces of hardware.

So what the chip is actually doing what the radio chip is doing, is it's speaking the physical and data link layers. The other higher layers in the OSI stack are handled by other controllers or other components on the system. And those things can be used across various protocols.

So those are the two protocols, those are the radio layers that we're really interested in. And so, if you don't have to deal with hardware defined radio, if you have more flexibility you can use what's called a software defined radio. And this is kind of the basis of Bastille's technology.

So here's our very small software defined radio. And the idea there is that I plug an antenna into this and this circuit board takes the RF energy and then it digitizes it and over USB I can submit it to a computer. And on the computer I can implement the physical layer and the data link layer.

So now I have the flexibility to implement any protocol I want. And I can tell this radio to tune to any frequency from the low megahertz, up to the middle, to the high gigahertz frequencies. If I want to talk 2.4 I can. If I want to talk 400 megahertz, I can.

Which gives you tons of flexibility. Now you can do all the protocols in one piece of hardware. When we say data link and physical layers, what do we actually mean? Here's a block diagram of the various components in those two layers. So the data, either a sensor in your IOT.

You IOT sensor is talking to your hub it needs some data. And when it wants to transmit that data to the hub it goes through these steps. First, it encodes the data. So it does error control coding. It adds redundancy to the data so that if any of the data is corrupt, it can recover it robustly.

The module is it? So it's taking ones and zeros and then turning those into modulated symbols that can be transmitted over the air. Those modulated symbols still happen on in digital time. So the next step is digital analog conversion. What that does is it takes this discrete time signal and turns it into a continuous time signal.

And then the next step is up conversion. So at the end of the D to A block, I have a signal that is what is called base van. And what I need to do is take that signal and put it up at 2.4 gigahertz or whatever frequency I want to transmit it.

So that's what the up conversion block is. And then the last block in my chain is power amplifier. Which is followed by the antenna. So power amplifier makes my signal louder. And the antenna transmits it over the air. And then I receive it and do the reverse process.

So if you take that block diagram and scrunch it up, you can map it to this software to find a radio block diagram, so this is a BladeRF. Which is similar to the radio in here, so there's a USB block. There's an FPGA block that's doing some of the low-level processing.

There's an RF front in, that's where the up conversion, down conversion, and digital to analog conversion happens. And then there's some clock circuitry that drives the D to A and the up convertor. So in order to go to more gigahertz that circuit needs to be driven by a signal that's 2.4 gigahertz, that's spinning at 2.4 gigahertz.

And so this is what the clock circuitry does. So that's kind of the lay of the land. If we dig into a couple of those blocks, we dig into the modulation block specifically, I've got some diagrams here that illustrates some of the modulation options. So amplitude modulation is one option where I encode ones and zeros by changing the amplitude of the signal.

And, the period at which I do that. So if I a have a one, or a zero every second, that's called a symbol period. Symbol period in that case would be one second. And you can see the signal period in this diagram. It's when things change. That symbol period dictates what's called the bandwidth signal.

So of Wifi, for instance it operates at 2.4 gigahertz. But it's actually 20 megahertz wide. And that 20 megahertz width is called a bandwidth. 20 megahertz is actually fairly wide. Bluetooth is one megahertz wide. So, depending on the signal it can be wider or narrower. And what that dictates is this symbol rate.

So that's how often I'm sending signals. So the signals can be ones or zeros. Or they can be GPSK signals. Or other sorts of things. Okay, so that's the amplitude modulation. There's also the phase modulation, where I change the phase in order to indicate symbols. And then there's frequency modulation where I change the frequency of the signal to indicate one symbol versus another.

So here's a screen capture of this spectrogram of various radio stations. So radio stations, you probably know are FM radio station, or frequency modulated radio stations. And when you plot them in a spectrogram like this you can see time versus frequency. You can actually see the frequency modulation.

So that's the squiggles you see going down the page are the voice of the audio broadcast. So that modulation that describes how I talk to someone else, and how they talk to me. Once you know, so that's really just one party one way communication. So the next thing you have to work out is how you talk to each other.

How do you share the channel so that I can talk, and you can talk, without us talking over each other. That's called duplexing. So, when I'm trying to work out how a conversation works with my counter party it's duplexing. And I can either do that in time where I talk, and then you talk, and then I talk.

Or, in frequency. So, I can speak on one frequency say 900 megahertz. And say you speak on 2.4 gigahertz. And since we're far apart in frequency we're not interfering with each other. So that's frequency division duplexing. That's pair conversations. There's also the problem of this pair of people is communicating and that pair of people is communicating.

So you can think of a noisy room situation where there's a party, and there's many many conversations going on. How do you deconflict them? Well at a party, all you really do is get further away. So that's spatial multiple access. We're each using this channel. We have multiple accesses in the channel that's the idea there.

And we're far enough away that we're sharing the channel by separating its space. But there's other options. One is, to share it in time. So this pair of people communicates in one time and they stop talking, and this pair of people starts talking. And they work out some scheme where they do that.

The other option is, this pair of people is in one frequency, and this is in another. So, if your wireless access point is at channel six, your neighbor's might be at channel 11. And that's a happy medium where you can both access the channel without having to share share in time.

So here's a plot of DECT which is the wireless standard used in headsets in call centers. And we can see, so when I recorded this, I was close to a handset. So you can see the handset signal is much stronger than the basestation signal. And you can see they're operating at different times.

So that's en example of time division duplexing. Because the basestation is talking to the handset they're conversational partners. I've also, so I turn on the second basestation. The second pair of these. And, in this example, in DECT the two basestations are using frequency division multiple access. So it's two pairs of conversations going on.

And you can see in the plot here frequency is in the X-axis. The two signals are two different frequencies. So that's FDMA frequency division multiple access. LTE does a combination of multiple access schemes. So it shares resources both in time and in frequency. So here I've got a plot of the resource grid.

So now the frequency is in the Y-axis and time is in the X-axis. And each one of those squares is a resource block that can be used by a user. So you have many conversations going on at each time. And each conversation each piece of the conversation is (mumbling) one of those blocks.

So here's a spectrum plot of LTE. And you can see the dense pieces. So those are little resource blocks getting taken out by various users. And you can see there's a long stretch there where some user is transmitting for a few milliseconds. Which is a fairly long period of time in LTE.

Again, I'm Bob Baxley with Bastille. Thanks for listening.

We’d love to show you around

Learn how Bastille can help you prepare you for today’s ever-growing wireless threat landscape, and schedule a demo and we’ll be in touch shortly.