Radio Theory Basics

Every wireless device in your building — badge readers, headsets, smart TVs, phones, sensors — is a radio. Understanding how those radios are built, and how they turn bits into energy in the air and back again, is the foundation for understanding why wireless is so hard to monitor and so easy to abuse. In this talk, Bastille Chief Engineer Dr. Bob Baxley walks through the basics of radio theory: hardware defined radios, software defined radios, and the physical and data link layers where all of the interesting security questions live.

The starting point is a simple observation. A typical IoT hub contains a separate chip for every protocol it speaks — one for Bluetooth, one for Wi-Fi, one for Z-Wave, one for Zigbee, and so on. Each chip is locked to one frequency and one protocol. That is cost-effective for a consumer product, but it is exactly the wrong architecture for security monitoring, where you need to see everything at once.

Software defined radio flips the model. A single flexible receiver digitizes RF energy and hands it to a computer, where the physical and data link layers are implemented in software. One piece of hardware, tuned anywhere from the low megahertz to the high gigahertz, can decode any protocol you can write code for. That flexibility is the basis of Bastille’s sensor technology.

Key takeaways

• Hardware defined radios are single-purpose: a discrete chip per protocol, locked to one frequency and one standard, which is why most devices can only ever see their own traffic.
• Software defined radios are protocol-agnostic: the radio digitizes raw RF and software implements the rest, so one sensor can tune across the spectrum and demodulate many protocols.
• Radio chips handle only two OSI layers: the physical and data link layers — encoding, modulation, conversion, and transmission. Everything above that is handled elsewhere and is largely protocol-independent.
• The transmit chain is always the same five steps: error control coding, modulation, digital-to-analog conversion, up-conversion, and power amplification into the antenna. Receiving is the same chain in reverse.
• Modulation comes in three flavors: amplitude, phase, and frequency — each encodes symbols by varying a different property of the carrier.
• Symbol rate dictates bandwidth: Wi-Fi occupies roughly 20 MHz of bandwidth at 2.4 GHz, while Bluetooth occupies about 1 MHz — a signal’s width is a fingerprint as much as its center frequency.
• Duplexing solves two-way conversation: partners either alternate in time (TDD) or separate in frequency (FDD) so they don’t talk over each other.
• Multiple access solves the crowded room: many simultaneous conversations share a channel by separating in space, time, or frequency — and modern standards like LTE combine several schemes at once.

Hardware defined radios: one chip per protocol

Open up a consumer IoT hub and you’ll find a circuit board with discrete radio sections annotated across it. One section handles Bluetooth. Another handles Wi-Fi. Others handle Z-Wave, Zigbee, Lutron, and whatever proprietary protocols the vendor decided to support. Each section contains a chip that operates at exactly one frequency and speaks exactly one protocol.

This is a cumbersome way to build a hub that talks to a dozen device families, but it remains the most cost-effective approach for a mass-market product. What it reveals is the fundamental inflexibility of most RF chips: if you want to speak multiple protocols, you need multiple pieces of hardware.

Those chips are doing a specific and limited job. They implement the physical layer and the data link layer of the OSI stack. The higher layers are handled by other controllers and other components in the system, and those upper-layer components can generally be reused across protocols. The radio layers are where protocols actually differ — and they are the layers a security team needs visibility into.

Software defined radio: flexibility as a security capability

A software defined radio (SDR) is small — a circuit board with an antenna connector and a USB port. Plug in an antenna and the board takes the RF energy from the air, digitizes it, and streams the samples over USB to a computer. The physical layer and data link layer are then implemented in software on that computer.

Two things follow from that architecture:

• Any protocol. Because demodulation and decoding happen in software, adding support for a new protocol is a software problem, not a hardware refresh.
• Any frequency. The radio can be told to tune anywhere from the low megahertz up through the high gigahertz. 2.4 GHz, 900 MHz, 400 MHz — same hardware.

That combination is what makes broad-spectrum wireless monitoring possible at all. Instead of deploying a separate sensor for every protocol you care about, one sensor array covers the range where enterprise wireless activity actually lives.

What the physical and data link layers actually do

When an IoT sensor has data to send to its hub, that data passes through a chain of processing blocks before it ever hits the air:

1. Error control coding. Redundancy is added to the data so the receiver can recover the message even if part of it is corrupted in transit.
2. Modulation. The ones and zeros are turned into modulated symbols suitable for transmission over the air.
3. Digital-to-analog conversion. The discrete-time signal becomes a continuous-time signal.
4. Up-conversion. The baseband signal coming out of the D/A stage is shifted up to the target carrier frequency — 2.4 GHz, or wherever the protocol operates.
5. Power amplification. The signal is made louder, then handed to the antenna and radiated.

Reception is the same chain run backwards: the antenna picks up the signal, it is down-converted, converted from analog to digital, demodulated, and decoded.

Mapping the chain onto real SDR hardware

On an SDR board such as a BladeRF, those blocks map onto identifiable hardware sections: a USB block for host communication, an FPGA doing low-level processing, an RF front end where up-conversion, down-conversion, and analog-to-digital conversion happen, and clock circuitry driving the converters and mixers. To operate at 2.4 GHz, that circuitry has to be driven by a clock running at 2.4 GHz — the clock chain is what makes the tuning range possible.

Modulation: how bits become waveforms

Modulation is the step where information gets impressed on a carrier wave. There are three basic properties available to vary:

• Amplitude modulation. Ones and zeros are encoded by changing the strength of the signal.
• Phase modulation. Symbols are indicated by shifting the phase of the carrier.
• Frequency modulation. Symbols are indicated by shifting the frequency of the carrier. FM radio is the everyday example — on a spectrogram, the audio being broadcast is visible as squiggles moving through frequency over time.

Symbol period, symbol rate, and bandwidth

The interval at which the signal changes from one symbol to the next is the symbol period, and its inverse is the symbol rate. The symbol rate is what sets the bandwidth of the signal — how much spectrum it occupies.

This is why center frequency alone doesn’t identify a protocol. Wi-Fi operates at 2.4 GHz but is about 20 MHz wide, which is fairly wide. Bluetooth also lives in 2.4 GHz but is roughly 1 MHz wide. Two signals in the same band, with very different footprints — and that footprint is one of the things a monitoring system uses to tell them apart.

Duplexing: taking turns in a conversation

Modulation describes one-way communication. Two devices holding a conversation need a scheme for not talking over each other — that’s duplexing, and there are two ways to do it:

• Time division duplexing (TDD). I talk, then you talk, then I talk. The pair shares one frequency and alternates in time.
• Frequency division duplexing (FDD). I transmit on one frequency, you transmit on another, far enough apart that we don’t interfere. Both sides can talk at once.

DECT, the standard used in call-center headsets, is a clean example. Capture a handset and its base station on a spectrogram and you can see them transmitting at different times on the same frequency — time division duplexing in action, with the nearby handset appearing much stronger than the base station.

Multiple access: many conversations, one channel

Duplexing handles one pair. Multiple access handles the crowded party — many pairs of devices sharing the same spectrum. There are three basic strategies:

• Spatial. Conversations separate by moving apart, the same way people at a party do. Both pairs use the channel, but distance keeps them from interfering.
• Time division multiple access. One pair transmits, stops, and another pair transmits, according to an agreed scheme.
• Frequency division multiple access. Each pair uses a different frequency. Your access point sits on Wi-Fi channel 6 while your neighbor’s sits on channel 11, and neither has to wait for the other.

Add a second DECT base station to the earlier capture and both schemes appear at once: each base station and handset pair alternates in time, while the two pairs sit on different frequencies — FDMA layered on top of TDD.

LTE: combining schemes in a resource grid

LTE combines multiple access schemes, sharing resources in both time and frequency. Its resource grid plots frequency on one axis and time on the other, divided into resource blocks that get allocated to individual users. Many conversations run concurrently, each occupying its own set of blocks.

On a spectrum plot of live LTE, that allocation is visible directly: dense clusters where resource blocks are being consumed by different users, and occasionally a long unbroken stretch where a single user transmits for several milliseconds — a long time by LTE standards.

Why this matters for wireless security

These fundamentals explain the shape of the wireless visibility problem. Devices built on hardware defined radios can only see their own protocol, so a Wi-Fi infrastructure has no idea what Bluetooth, cellular, or proprietary IoT devices are doing around it. Protocols are distinguished not only by frequency but by bandwidth, modulation, duplexing, and multiple access behavior — which means a monitoring system has to understand the physical layer, not just parse packets.

Software defined radio is what makes broad coverage practical: one flexible sensor platform, tuned across the bands where enterprise devices actually operate, with protocol support implemented and extended in software as new threats appear.

Full Transcript

Hi, welcome to this talk on radio theory basics. My name’s Bob Baxley, and I’m the Chief Engineer at Bastille, where I run the radio and data science teams. In this talk I want to give you a feeling for how software defined radios work, and how their predecessor, hardware defined radios, work.

Hardware defined radios

To kick that off, I’ve got a picture here of the internals of a Wink hub, which is a home IoT hub made to interface and talk to all these wireless peripherals — Bluetooth, Wi-Fi, Z-Wave, Kidde, Lutron, Zigbee. There are all these different standards, and this device can talk to them all. The way that it does that, as I’ve annotated on this diagram, is that it actually has discrete circuits for each one of these protocols. In those circuits there’s a discrete chip that operates at exactly that frequency and speaks exactly that protocol.

This is a somewhat cumbersome way to have an IoT hub that talks to a bunch of things, but for now it’s the most cost-effective way to do it. What it displays, though, is the lack of flexibility in most of these RF chips. If I want to speak multiple protocols, I need multiple pieces of hardware.

What the radio chip is actually doing is speaking the physical and data link layers. The other, higher layers in the OSI stack are handled by other controllers or other components on the system, and those things can be used across various protocols. So those are the radio layers that we’re really interested in.

Software defined radios

If you don’t have to deal with hardware defined radio, if you have more flexibility, you can use what’s called a software defined radio. This is the basis of Bastille’s technology.

Here’s our very small software defined radio. The idea is that I plug an antenna into this, and this circuit board takes the RF energy, digitizes it, and over USB I can submit it to a computer. On the computer I can implement the physical layer and the data link layer. So now I have the flexibility to implement any protocol I want, and I can tell this radio to tune to any frequency from the low megahertz up to the middle, to the high gigahertz frequencies. If I want to talk 2.4, I can. If I want to talk 400 megahertz, I can. That gives you tons of flexibility — now you can do all the protocols in one piece of hardware.

Inside the data link and physical layers

When we say data link and physical layers, what do we actually mean? Here’s a block diagram of the various components in those two layers. Say an IoT sensor is talking to your hub and it needs to send some data. When it wants to transmit that data to the hub, it goes through these steps.

First it encodes the data — error control coding. It adds redundancy to the data so that if any of the data is corrupt, it can be recovered robustly. Then there’s the modulator: it’s taking ones and zeros and turning those into modulated symbols that can be transmitted over the air. Those modulated symbols still happen in digital time, so the next step is digital-to-analog conversion, which takes this discrete-time signal and turns it into a continuous-time signal.

The next step is up-conversion. At the end of the D-to-A block, I have a signal that is what’s called baseband, and what I need to do is take that signal and put it up at 2.4 gigahertz, or whatever frequency I want to transmit at. That’s what the up-conversion block does. The last block in my chain is the power amplifier, which is followed by the antenna. The power amplifier makes my signal louder, and the antenna transmits it over the air. Then I receive it and do the reverse process.

If you take that block diagram and scrunch it up, you can map it to this software defined radio block diagram — this is a BladeRF, which is similar to the radio here. There’s a USB block. There’s an FPGA block doing some of the low-level processing. There’s an RF front end, where the up-conversion, down-conversion, and digital-to-analog conversion happen. And there’s some clock circuitry that drives the D-to-A and the up-converter. In order to go to 2.4 gigahertz, that circuit needs to be driven by a signal that’s spinning at 2.4 gigahertz. That’s what the clock circuitry does. So that’s the lay of the land.

Modulation and bandwidth

If we dig into the modulation block specifically, I’ve got some diagrams that illustrate the modulation options. Amplitude modulation is one option, where I encode ones and zeros by changing the amplitude of the signal, and the period at which I do that matters. If I have a one or a zero every second, that’s called a symbol period — the symbol period in that case would be one second. You can see the symbol period in this diagram: it’s when things change.

That symbol period dictates what’s called the bandwidth of the signal. Wi-Fi, for instance, operates at 2.4 gigahertz, but it’s actually 20 megahertz wide, and that 20 megahertz width is called its bandwidth. 20 megahertz is fairly wide; Bluetooth is one megahertz wide. Depending on the signal, it can be wider or narrower, and what dictates that is the symbol rate — how often I’m sending symbols.

So that’s amplitude modulation. There’s also phase modulation, where I change the phase in order to indicate symbols. And there’s frequency modulation, where I change the frequency of the signal to indicate one symbol versus another.

Here’s a screen capture of a spectrogram of various radio stations. FM radio stations are frequency modulated, and when you plot them in a spectrogram like this you can see time versus frequency — you can actually see the frequency modulation. Those squiggles you see going down the page are the voice of the audio broadcast.

Duplexing

Modulation describes how I talk to someone else and how they talk to me, but that’s really just one-way communication. The next thing you have to work out is how you talk to each other — how you share the channel so that I can talk and you can talk without us talking over each other. That’s called duplexing.

I can do that in time, where I talk, then you talk, then I talk. Or in frequency: I can speak on one frequency, say 900 megahertz, and you speak on 2.4 gigahertz. Since we’re far apart in frequency, we’re not interfering with each other. That’s frequency division duplexing.

Multiple access

That’s pairs of conversations. There’s also the problem of one pair of people communicating while another pair of people is communicating. You can think of a noisy room situation where there’s a party and there are many, many conversations going on. How do you deconflict them? At a party, all you really do is get further away — that’s spatial multiple access. We’re each using the channel, and we’re far enough away that we’re sharing it by separating in space.

There are other options. One is to share it in time: this pair of people communicates at one time, they stop talking, and this other pair starts talking, and they work out some scheme to do that. The other option is that this pair of people is on one frequency and that pair is on another. If your wireless access point is on channel six, your neighbor’s might be on channel 11. That’s a happy medium where you can both access the channel without having to share in time.

Here’s a plot of DECT, the wireless standard used in headsets in call centers. When I recorded this, I was close to a handset, so you can see the handset signal is much stronger than the base station signal, and you can see they’re operating at different times. That’s an example of time division duplexing, because the base station is talking to the handset — they’re conversational partners.

I also turned on a second base station, a second pair. In DECT, the two base stations are using frequency division multiple access, so there are two pairs of conversations going on. You can see in the plot here that frequency is on the x-axis, and the two signals are at two different frequencies. That’s FDMA — frequency division multiple access.

LTE does a combination of multiple access schemes, sharing resources both in time and in frequency. Here I’ve got a plot of the resource grid, where frequency is on the y-axis and time is on the x-axis. Each one of those squares is a resource block that can be used by a user, so you have many conversations going on at each time, with each piece of each conversation occupying one of those blocks.

Here’s a spectrum plot of LTE. You can see the dense pieces — those are little resource blocks getting taken up by various users. And you can see there’s a long stretch there where some user is transmitting for a few milliseconds, which is a fairly long period of time in LTE.

Again, I’m Bob Baxley with Bastille. Thanks for listening.