See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/260868924

SPD-driven Smart Transmission Layer based on a Software Defined Radio Test

Bed Architecture

Conference Paper · January 2014

CITATIONS READS

10 2,121

3 authors:

Kresimir Dabcevic Lucio Marcenaro

Università degli Studi di Genova Università degli Studi di Genova
13 PUBLICATIONS 137 CITATIONS 247 PUBLICATIONS 3,181 CITATIONS

SEE PROFILE SEE PROFILE

Carlo S. Regazzoni
Università degli Studi di Genova
593 PUBLICATIONS 7,816 CITATIONS

SEE PROFILE

All content following this page was uploaded by Kresimir Dabcevic on 30 September 2014.

The user has requested enhancement of the downloaded file.

 SPD-driven Smart Transmission Layer Based on a Software Defined
Radio Test Bed Architecture

Kresimir Dabcevic1 , Lucio Marcenaro1 and Carlo S. Regazzoni1

1 DITEN, University of Genova, Genoa, Italy

{kresimir.dabcevic, mlucio, carlo}@ginevra.dibe.unige.it

Keywords: Cognitive Radio, Software Defined Radio, Smart Transmission Layer, Security, Privacy, Dependability,
nSHIELD, Test Bed, SDR, CR, Jamming, Energy Detector Spectrum Sensing.

Abstract: Cognitive Radio as a technological breakthrough and enabler for concepts such as Opportunistic Spectrum
Access and Dynamic Spectrum Access has so far received significant attention from the research community
from a theoretical standpoint. In this work, we build upon the theoretical foundation and present an implemen-
tation of a Software Defined Radio/Cognitive Radio platform, with the feature under particular interest being
the so-called Smart Transmission Layer. Smart Transmission Layer is a feature developed within the currently
ongoing nSHIELD project, whose goal is establishing new paradigms for Security, Privacy and Dependability
(SPD) of the future embedded systems. The role of the SPD-driven Smart Transmission Layer is providing re-
liable and efficient communications in critical channel conditions by using adaptive and flexible algorithms for
dynamically configuring and adapting various transmission-related parameters. The implementation was done
on the test bed consisting of two Secure Wideband Multi-role - Single-Channel Handheld Radios (SWAVE
HH) coupled with the powerful proprietary multi-processor embedded platforms, and the corresponding aux-
iliaries. Several case studies were performed, namely: remote control of the radios, analysis of the installed
waveforms, interference detection, and spectrum sensing using a quasi-real-time energy detector. A roadmap
towards the future implementation aspects using the test bed was set.

1 INTRODUCTION of the existing machine learning techniques, and in

addition may potentially be equipped with smart an-
tennas, geolocation capabilities, biometrical identifi-
With the continuous market penetration of many
cation and so on (Fette, 2006).
spectrum-demanding radio-based services, such as
video broadcasting, finding ways to increase the spec- However, the newly-introduced cognitive capabil-
trum usage efficiency has become a necessity. Cogni- ities are precisely what make Cognitive Radios sus-
tive Radio (CR) is a technological breakthrough that ceptible to a whole new set of security issues and
is expected to be an enabler for these improvements possible breaches (Dabcevic et al., 2013). In addi-
by utilizing concepts such as Opportunistic Spectrum tion, SDR-based CRs inherit the vulnerabilities char-
Access (OSA) and Dynamic Spectrum Access (DSA), acteristic to Software Defined Radios, as well as the
making it a current hot topic within the radio com- security issues stemming out from their wireless na-
munication research community. Cognitive radio can ture (Fragkiadakis et al., 2013). Addressing all of the
be described as an intelligent and dynamically recon- aforementioned is, therefore, paramount for ensuring
figurable radio that can adaptively regulate its inter- the secure, fault-tolerant operation of future Cognitive
nal parameters in response to the changes in the sur- Radio Networks.
rounding environment. Namely, its parameters can Addressing security, privacy and dependability is-
be reconfigured in order to accommodate the current sues, and providing safe and robust communication
needs of either the network operator, spectrum lessor, in Software Defined Radio and Cognitive Radio Net-
or the end-user. works is role of the SPD-driven Smart Transmission
Cognitive Radio (Mitola and Maguire, 1999) is Layer - one of the features of the nSHIELD (new Sys-
commonly defined as an upgraded and enhanced Soft- tems arcHItecturE for multi-Layer Dependable solu-
ware Defined Radio (SDR). Typically, full Cognitive tions) framework. This paper gives an overview of the
Radios will have learning mechanisms based on some SDR test bed architecture that will be used for devel-
opment and experimentation of various Smart Trans- (BEE2), and reconfigurable 2.4 GHz RF front ends,
mission Layer features, providing proof-of-concept in using fiber links for inter-communication. BEE2
terms of demonstrating several important functionali- engine consisted of five Xilinx Virtex-2 Field Pro-
ties that will aid future research. grammable Gate Arrays (FPGAs), and supported con-
Wireless communication is fundamentally suscep- nection of up to 18 individual RF front-ends, mak-
tible to variation and upset due to the nature of the ing the Multiple Input Multiple Output (MIMO) ex-
transmission medium, nodes mobility, noise, and in- perimentation possible. The RF front-ends supported
terference. Because of that, it was decided to as- up to 25 MHz bandwidth in a 85 MHz frequency
semble a simulated RF bench, which exhibits several range. All signal processing was being done directly
clear-cut advantages compared to over-the-air trans- on the platform. The software architecture was based
mission, namely: on Matlab Simulink, coupled with the Xilinx System
• possibility of setting accurate and stable RF lev- Generator library enhanced by a set of blocks in order
els, to support interfaces with Analog-to-Digital Convert-
ers and Double data rate (DDR) memory. The major-
• test instruments and generators can be connected ity of the focus of the research was placed upon the
to one or more branches, spectrum sensing implementations, showing the prac-
• possibility of mimicking complex dynamic be- tical performance and constraints of energy detectors
haviors of the transmission channel, (Cabric et al., 2006) and cyclostationary feature de-
tectors (Tkachenko et al., 2006) in imperfect channel
• replicability of the tests without the typical uncer-
conditions.
tainties of over-the-air transmission.
The remainder of this work is structured as fol-
lows: related work on Software Defined Radio and
Cognitive Radio platforms and test beds is given in Kansas University Agile Radio (KUAR) (Minden
section 2. Section 3 presents the ideas and premises et al., 2007) was a low-cost experimental SDR plat-
driving the nSHIELD project, as well as the archi- form based on an embedded 1.4 GHz General Pur-
tectural overview of the nSHIELD-compliant devices pose Processor (GPP), Xilinx Virtex-2 FPGA, and
and systems. Implementation details of the proposed a RF front-end with 30 MHz bandwidth. The RF
SDR/CR test bed architecture are given in section 4, front-end was designed to operate in the 5-6 GHz
whereas exercised functionalities that have reached frequency band. The majority of the signal process-
demonstrable level are described in section 5, along ing was delegated to the FPGA, which is targeted us-
with the experiment results. Conclusions and the ing the software libraries running Linux OS. KUAR’s
roadmap are presented in section 6. software architecture consisted of a set of Applica-
tion Programming Interfaces (APIs), comprising the
KUAR Control Library. The research topics up to
date included implementation of agile transmission
2 EXISTING COGNITIVE RADIO techniques; distributed radio spectrum survey, and
TEST BEDS AND PLATFORMS channel sounding techniques.

Software Defined Radios and Cognitive Radios were

given significant attention from the research commu-
nity over the last years. However, most of the con- Maynooth Adaptable Radio System (MARS)
tributions have focused on theoretical modeling and (Farrell et al., 2009) was another experimental
analysis. As useful as the simulation environment is SDR/CR platform, consisting of an RF front end in-
for the algorithm research and development, simula- terconnected with a personal computer, where all the
tors of wireless systems necessarily introduce many signal processing burden was placed on the PC’s GPP.
abstractions, often leading to losing track of important The platform operated in the 1.75-2.45 GHz range,
real-life constraints and obstacles. As such, demon- with the direct conversion architecture implemented
strating effectiveness of wireless systems’ cognitive both at the transmitting and the receiving side. The
features on a simulation basis only is not sufficient. proprietary software architecture, called IRiS, was
Instead, these features need to be executed and evalu- highly reconfigurable, and was compatible with both
ated on real-life test beds. Windows and Linux. A set of use-cases, such as spec-
Researchers at the Berkeley Wireless Research trum sensing; image and video transmission, and in-
Center have developed an experimental cognitive ra- teroperability with other SDR platforms, was studied
dio platform based on the Berkeley Emulation Engine and implemented using the platform.
3 nSHIELD - APPLICATION OF where the first ones are capable of deploying one
SECURITY, PRIVACY AND or more of the SPD functionalities, whereas the
latter ones don’t have the SPD functionalities em-
DEPENDABILITY IN THE bodied, but are able to communicate and inter-
CONTEXT OF EMBEDDED operate with the nSHIELD-enabled nodes. Ex-
SYSTEMS amples of currently available commercial embed-
ded platforms that correspond to the definition of
Ever-increasing complexity and scope of capabilities Nano nodes are e.g. Zolertia Z1 (Zolertia, 2013),
of modern communication devices and systems inher- Arduino Uno (Arduino, 2013) and Memsic IRIS
ently bring a set of new security and dependability is- (Memsic, 2013).
sues. In the domain of embedded systems, especially • Micro nodes – mid-class unconstrained nodes
those consisting of constrained low-end devices, im- with medium computational capabilities, embod-
plementation of appropriate security measures is of- ied with a single GPP and able to run Linux ker-
ten not adequately addressed. nels. They are typically DC-powered and have
Providing a complete, unified framework for Se- the potential for deployment of a large number of
curity, Privacy and Dependability (SPD) for a variety SPD functionalities. Examples of commercially
of embedded devices and systems is the goal of the currently available embedded platforms that cor-
currently-ongoing nSHIELD project (nSHIELD Con- respond to the definition of Nano nodes are e.g.
sortium, 2012). nSHIELD framework envisions a sys- Beaglebone (Beagleboard, 2013c), Beagleboard
tem architecture (see Figure 1) that consists of four (Beagleboard, 2013a) and Raspberry PI (Raspber-
functional layers: three horizontal ones - Node, Net- ryPiFoundation, 2013).
work and Middleware, all comprehended by the sin- • Power nodes – high-class unconstrained nodes
gle vertical layer called Overlay. The SPD function- with advanced computational capabilities, typi-
alities are exercised at each of the horizontal layers, cally embodied with multiple processing units and
with the Overlay layer having a logical operational able to run high-level operating systems such as
control, i.e. being in charge of decision-making with WinCE and QNX. Examples of commercially-
respect to which of the SPD functionalities are to be available platforms that can be considered as
activated/deactivated at a particular time instance in power nodes are Beagleboard-xM (Beagleboard,
order to reach a desired SPD level. Desired SPD level 2013b) and ZedBoard (ZEDBoard, 2013). These
can either be imposed manually by the operator or, in nodes may further be embodied with the widely
case of intelligent automated systems, by the corre- tunable RF front end, or connected to the full
sponding cognitive entity. Software Defined Radio, making them a ”SDR-
capable power node”.
The full set of the SPD functionalities devel-
oped for the Node layer is shown in Figure 2.
Which of the functionalities are being exercised at
a given time instance depends on the node class
(Nano/Micro/Power) and the SPD level imposed by
the Overlay.
Figure 1: nSHIELD system architecture.

The Node layer encompasses physical elements

that constitute the nSHIELD network, and can be di-
vided into three basic types of embedded devices, dis-
tinguishable mainly by their computational capabili-
ties and power restrictions:
• Nano nodes – constrained battery-powered nodes
with low computational capabilities and low re-
configurability potentials. They typically require
a set of lightweight security protocols, and are
capable of running light operating system, i.e. Figure 2: SPD functionalities at the Node layer.
EasyOS, ContikiOS or Arduino. Nano nodes
can further be subdivided into nSHIELD-enabled The Network layer is a heterogeneous layer in
nano nodes and nSHIELD-compliant nano nodes, charge of provisioning an SPD-enabled communica-
tion between two or more nSHIELD nodes and/or SPD functionalities developed for the Network layer
the external world. It is composed of a common are outlined in Figure 3.
set of cooperating protocols, procedures, algorithms
and communication technologies, which are classified
into four innovative features:
• SPD-driven Smart Transmission Layer – feature
built specifically for the SDR-capable power
nodes (unconstrained devices with high reconfig-
urability potentials), whose goal is ensuring reli-
able and robust communication in harsh and criti-
cal conditions by utilizing on-the-fly reconfigura- Figure 3: SPD functionalities at the Network layer.
bility prospects of Software Defined Radio tech-
nology and - eventually - the learning prospects The Middleware is a software layer installed in
that Cognitive Radio technology brings. the nSHIELD nodes, whose complexity depends on
the node class - lightweight middleware solutions are
• Distributed Self-x Models – a set of distributed deployed for the nano nodes, and high-complex solu-
self-management and self-coordination schemes tions for the power nodes. Middleware acts as ”glue”
for unmanaged and hybrid managed/unmanaged for different SPD services offered by the nSHIELD
networks, whose goal is reducing the vulnerabil- system, as - by means of dedicated protocols, con-
ity to attacks depleting communication resources trol algorithms and interfaces - it allows for the ab-
and node energy. This feature is not dependent straction, discovery, composability and control of all
upon the node class, but rather upon the network of them. Middleware services and functionalities are
model and topology. depicted in Figure 4.
• Reputation-based Resource Management Tech-
nologies – when possible, keeping track of the be-
haviour of the network’s nodes can provide sig-
nificant improvements to the overall security, as it
can assist in singling out continuous anomalous,
malicious and unwanted behaviour. Hence, this
feature (Gerrigagoitia et al., 2012) will provide
efficient solutions based on trust level and repu-
tation tracking, allowing for secure routing pro-
tocols and functional intrusion detection systems
at the communication level. In centralized net-
works, Reputation-based RMTs will be deployed
at the central entity, thus being independent of the
classes of nodes that comprise the network. In ad-
dition to that, certain aspects of Reputation-based
Figure 4: SPD functionalities at the Middleware layer.
RMTs are tailored and deployed to suit each of
the node types, allowing for the feature to ensure The Overlay is a logical vertical layer in charge of
SPD provisioning (to a certain level) in distributed deciding, in accordance with the control algorithms
environments as well. and policies, which SPD functionalities should be ac-
• Trusted and Dependable Connectivity – refers to tivated/deactivated at a given time instance, and to tai-
the set of SPD communication protocols deployed lor them in order to reach the nSHIELD objectives
at the network and link layer, whose focus is (i.e. the desired SPD level). This layer is indeed a
put on lightweight adaptations of the well-known software routine running over the nSHIELD Middle-
Transport Layer Security (TLS) protocol, Data- ware, which uses Middleware core services in order
gram Transport Layer Security Protocol (DTLS) to collect information and actuate its decision-making
and Internet Protocol SECurity (IPsec) (Rantos process. nSHIELD Overlay offers five services, par-
et al., 2013) with its encoded version for IPv6 tially overlapping with the services offered by Mid-
over Low power Wireless Personal Area Net- dleware. They are depicted in Figure 5.
works (6LoWPAN). In addition, this work task Validation of the concepts developed within the
deals with the access control applied specifically nSHIELD project will be demonstrated by the means
to Smart Grid networks. of four independent scenarios/demonstrators:
 Being a military technology, several technical
characteristics of SWAVE HH, i.e. processor specifi-
cations and more in-depth operational details are non-
disclosable.
HH has an integrated commercial Global Position-
ing System (GPS) receiver, but also provides the in-
terface for the external GPS receiver. GPS data is
Figure 5: SPD functionalities at the Overlay layer. available in National Marine Electronics Association
(NMEA) format and may be outputted to the Ethernet
port.
• Urban railways protection
Radio is powered by Li-ion rechargeable batter-
• Voice/facial recognition ies, however may also be externally powered through
• Dependable avionic systems a 12.6V direct current (DC) source. Relatively small
physical dimensions (80x220x50 mm), long battery
• Social mobility life (8 hours at the maximum transmission power for
For page limitation purposes, we are omitting a a standard 8:1:1 duty cycle), and acceptable weight
more detailed outlook on the demonstrators, and the (960g with battery) allow for portability and unteth-
project’s ideas and methodologies as a whole. These ered mobile operation of the device.
may, however, be found at (nSHIELD Consortium, Hypertach expansion at the bottom of HH pro-
2012), (Fiaschetti et al., 2012), (Esposito et al., 2013), vides several interfaces, namely: 10/100 Ethernet;
(Flammini et al., 2011). The focus is instead placed USB 2.0; RS-485 serial, DC power interface (max
on the implementational details of the SPD-driven 12.7V), and PTT. The radio provides operability in
Smart Transmission Layer, and the corresponding test both Very High Frequency - VHF (30 - 88 MHz),
bed architecture, discussed in more detail in the next and Ultra High Frequency - UHF (225 - 512 MHz)
section. band. The software architecture of the radio is com-
pliant with the Software Communications Architec-
ture (SCA) 2.2.2 standard. Following that, HH pro-
vides support for both legacy and new waveform
4 TEST BED ARCHITECTURE types. Currently, two functional waveforms are in-
stalled on the radio: SelfNET Soldier Broadband
The proposed Smart Transmission Layer SDR/CR Waveform (SBW) and VHF/UHF Line Of Sight (VU-
test bed consists of a number (currently: 2) of Se- LOS), as well as the waveform providing support
cure Wideband Multi-role - Single-Channel Hand- for the Internet Protocol (IP) communication in ac-
held Radios (SWAVE HHs), each interconnected with cordance with MIL-STD-188-220C specification (Li
the proprietarily developed multi-processor embed- et al., 1995). Currently installed waveforms will be
ded platform (Power node). described and analyzed in more details in section 5.2.

4.1 SWAVE HH architecture overview 4.2 Power node architecture overview

and connection to SWAVE HH
SWAVE HH (SelexES, 2013) (from now on referred
to as HH) is a fully operational SDR radio terminal ca- nSHIELD Power node is composed of a small form
pable of hosting a multitude of wideband and narrow- factor System-on-Module (SOM) with high computa-
band waveforms. Maximum transmit power of HH tional power - developed by Selex ES - and the corre-
is 5W, with the harmonics suppression at the trans- sponding carrier board. It is based on an ARM Cor-
mit side over -50 dBc. Superheterodyne receiver has tex A8 processor running at 1Ghz, encompassed with
specified image rejection better than -58 dBc. The powerful programmable Xilinx Spartan 6 FPGA and
receiver is fully digital; in VHF, 12-bit 250 MHz ana- Texas Instruments TMS320C64+ DSP. It can be em-
log to digital (AD) converters perform the conversion bodied with up to 1 GB LPDDR RAM, has support
directly at RF, while in UHF, AD conversion is per- for microSD card up to 32 GB, and provides inter-
formed at intermediate frequency (IF). No selective faces for different RF front ends. Support for IEEE
filtering is applied before ADC. Broadband digitized 802.11 b/g/n and ANT protocol standards are prof-
signal is then issued to the FPGA, where it under- fered. Furthermore, several other external interfaces
goes digital down conversion, matched filtering and are provided, i.e. 16 bit VGA interface; Mic-in, line-
demodulation. in and line-out audio interfaces; USB 2.0; Ethernet;
and RS-232 serial. The node is DC-powered, and tors had to be included in the coaxial path, and were
has Windows CE and Linux distribution running on programmed to their maximum attenuation value -
it. System architecture of the Power node is shown in 30 dB. Agilent 778D 100 MHz - 2GHz dual di-
Figure 6. rectional coupler with 20dB nominal coupling was
Connection to HH is achieved through Ethernet, placed between the attenuators, allowing for sam-
as well as serial port. Ethernet is used for the re- pling and monitoring the signal of interest. Agilent
mote control of the HH, using SNMP. For the serial E4438C vector signal generator was connected to in-
connection, due to different serial interfaces - RS- cident port of the coupler, with the purpose of in-
232 and. RS-485, a RS-232-to-RS-485 converter is jecting noise/interference signal to the network. Agi-
needed. Serial connection is used for transferring the lent E4440A spectrum analyzer was connected to the
spectrum snapshots from HH to Power node. More coupler’s reflected port, facilitating the possibility of
details on remote control and spectrum sensing are monitoring the RF activity. Simplified block diagram
given in sections 5.1 and 5.4, respectively. of the test bed, and implementation are shown in Fig-
ures 8 and 9 respectively.

Figure 8: Test bed simplified diagram.

Figure 9: SPD-driven Smart Transmission Layer test bed

implementation

5 CASE STUDIES
Figure 7: Implementations of SWAVE HH and the SOC Smart Transmission Layer based on the described test
Power node. bed architecture is currently in its early implemen-
tation phase. However, several basic functionalities
4.3 Assembled test bed have already reached demonstrable level. These will
be described in more details as follows.
Current test bed prototype is composed of two
SWAVE HHs, each interconnected with a Power 5.1 Remote control of the radio
node. A coaxial RF bench was implemented for the
frequency range of interest. Because of the high out- Using Simple Network Management Protocol v3
put power of the radios, two programmable attenua- (SNMP v3), several parameters of the HH radio may
 Figure 6: nSHIELD Power node - system architecture.

be externally controlled. For achieving this, SNMP ters that may be TRAPped, with the short description
manager has to be installed and running on the Power of the conditions under which TRAPping messages
node. The host (Power node) and the agents (HHs in are issued.
the network) are connected through an Ethernet hub,
and need to be on the same domain. 5.2 Waveform analysis
By utilizing three basic SNMP commands: GET,
SET and TRAP, it is possible to: read the current As previously stated, there are currently two func-
value of the parameter, set a new value, or issue a tional wavevorms installed on SWAVE HHs: SBW
message/warning if the current value satisfies a con- and VULOS. Having a wideband spectrum analyzer
dition, respectively. allows for monitoring the waveforms and analyzing
The controllable parameters and their correspond- their parameters.
ing features are stored in a Management Information SBW is a wideband multi-hop Mobile Ad-hoc
Base (MIB), which is loaded into the host’s SNMP NETwork (MANET) waveform, supporting operation
manager. MIB table contains all the definitions that in the 225 - 512 MHz part of the UHF band. The
define properties of the controllable parameters, and waveform provides self-(re)configurability and self-
describes each object identifier (OID), which is origi- awareness of the network structure and topology, for
nally a sequence of integers, with a string. up to 50 nodes and up to 5 hops. Furthermore, possi-
The list of the parameters that may be controlled bility of simultaneous streaming of voice and data ser-
externally, with the corresponding input data types, vices is provided, with prioritization for voice stream-
and the SNMP commands that may be invoked is ing (in case of exceeded bandwidth). Allocated chan-
given in Table 1. Since the parameters are self- nel bandwidth is adjustable - up to 5 MHz - with chan-
explanatory, we are omitting a detailed description on nel spacing of up to 2 MHz. SBW uses a fixed digital
them. ManageEngine MibBrowser Free Tool (Man- modulation technique.
ageEngine, 2013) was used as the SNMP manager Self-awareness is exercised by monitoring the net-
running on the power node. work topology for changes every n seconds (monitor
Accordingly, Table 2 provides list of the parame- interval is adjustable). Two Quality of Service (QoS)
Table 1: HH’s Parameters that may be remotely controlled
via SNMP.
Parameter Type SNMP commands
File Transfer Activation string SET/GET
File Transfer Type string SET/GET
FTP User Name string SET/GET
FTP Password string SET/GET
FTP Address string SET/GET
Login Username string SET/GET
Login Password string SET/GET
Transmit Power integer SET/GET
Transmitter On/Off integer SET/GET
Currently Installed Waveform string seq GET
Waveform’s MIB Root string GET
Waveform Status [ON/OFF] integer SET/GET
Audio Message ID string SET/GET
Create New Waveform string SET/GET
Activate Preset string SET/GET
Activate Mission File string SET/GET Figure 10: SBW waveform in the frequency domain - max
Audio Output Gain float SET/GET hold.
Battery Charge Percentage integer GET
File Download Status integer GET
Trap Receiver’s IP Address string SET/GET
Zeroize All Crypto Keys integer SET/GET
log modulation techniques: Amplitude Modulation
Crypto Key Loaded integer GET (AM) and Frequency Modulation (FM), which may
System End Boot [failed/ be configured on-the-fly, alongside with the modula-
succeeded/ in progress] integer GET tion index. Channel bandwidth is adjustable up to 25
kHz, with channel spacing also adjustable up to 25
Table 2: HH’s Parameters that may be TRAPped via SNMP. kHz. Furthermore, the VULOS waveform is able to
Parameter Description utilize both digital and analog voice Coder-Decoders
NET Radio OK The notification is triggered when the visibility
of the radio network is acquired
(CODECs) installed on the radio.
NET Radio FAIL The notification is triggered when the visibility Figure 11 shows envelope shape and properties of
of the radio network is lost
Critical Alarm The notification is triggered when the HH
FM-modulated VULOS waveform with the 25 kHz
has sustained a critical operational error bandwidth, transmitted at 1 dBW in VHF band (30
End Boot The notification is triggered when successful MHz).
boot-up of the HH has been verified
End File Download The trap notifies end of the procedure of file Waveform analysis will have an important SPD
download, indicating whether it was sucessful
Low Power The notification is triggered when the battery
application - by creating a database of waveform
charge falls below a pre-defined limit types that are occurring in the system, it will be pos-
Create Waveform OK The notification is triggered when the sible to identify potentially malicious or misbehaving
waveform is successfully created
Create Waveform FAIL The notification is triggered when the users.
waveform creation has failed

monitoring mechanisms are provided: Bit Error Rate

(BER) Test, and the statistics data for the transmit-
ting/receiving side. These mechanisms are provid-
ing means for analyzing and comparing the quality of
communication in regular and impaired channel con-
ditions. More in-depth analysis of these features is
presented in section 5.3.
Figure 10 shows envelope shape and properties of
the SBW waveform, for the maximum signal band-
width (5 MHz) and 1/10th of the maximum transmit
power (-3 dBW), in frequency domain.
VULOS is a narrowband single-hop waveform
designed for short-distance voice or data communi-
cation. It supports operation in both VHF (30-88 Figure 11: FM-modulated VULOS waveform in the fre-
MHz) and UHF (225-512 MHz) frequency bands. quency domain - max hold.
The waveform allows for choosing between two ana-
5.3 Interference detection ble.
In the second set of measurements, different types
Various Denial of Service (DoS) attacks - and in par- of interfering signals are created by the signal gener-
ticular jamming attacks - have for a long time been ator, namely: pulse signal as in the first measurement
posing - and continue to pose - significant security set; Real Time I/Q Baseband Additive White Gaus-
threats to radio networks. Radiofrequency (RF) jam- sian Noise (AWGN) with the effective bandwidth of
ming attacks refer to the illicit transmissions of RF 5 MHz; Real Time I/Q Baseband AWGN with the
signals with the intention of disrupting the normal effective bandwidth of 1 MHz, and a GSM signal.
communication on the targeted channels. RF jam- Once again, central frequency of all of the interfer-
ming is a known problem in modern wireless net- ing sources is the same as the frequency of the chan-
works, and not an easy one to counter using tradi- nel that the radios use for communication (225 MHz).
tional hardware-based equipment. Additionally, Soft- The results are shown in figure 13.
ware Defined Radios and Cognitive Radios bring the As expected, pulse signal has the best interfering
prospect for further improvement of the jamming ca- capabilities, due to the fact that it has the most con-
pabilities of the malicious users, however also of- centrated power, and - importantly - that it has been
fer the possibility of developing advanced protection- created at the exact frequency as the main carrier fre-
and counter-mechanisms (Tague, 2010), (Morerio quency of the transmitted signal. Even with small fre-
et al., 2012). quency offsets, interfering impact of the pulse signal
One of the main focuses of the SPD-driven Smart would drop significantly. For the same reason, ad-
Transmission Layer is precisely providing safe and dition of AWGN results in higher link degradation
reliable communication in jamming-polluted environ- in cases of smaller allocated bandwidth, due to the
ments. For that, a detailed study of various jamming higher power density. The vector signal generator is
attack strategies and development of appropriate se- only able to produce an AWGN signal of amplitude
curity solutions will be done. up to 20 dBm, hence the measurements for the higher
values were not done.
The vector signal generator is presently used as
means for creating disturbances in the communica- It should be noted that the results presented in this
tion channel, emulating a simple RF jammer. A set of subsection are for reference, instead of absolute pur-
measurements demonstrating how different types of poses - at this stage, the intention was not placed upon
created interfering signals influence the performance emulating real-life interferers, but rather at perform-
of the communication on the channel was done. ing the initial study of the interference detection func-
tionalities of the SWAVE HHs.
In the first set of measurements, the aim is to show
the correlation between Bit Error Rate (BER) and the
radio’s built-in Link Quality metric. Link quality is 5.4 Energy detection spectrum sensing
HH’s built-in QoS feature, and is represented by an
integer in the range of [0-200]. The measurements Obtaining information of the current spectrum occu-
are done with HHs having their signal bandwidths set pancy is paramount for the Cognitive Radios to be
to the maximum value (5 MHz), and repeated for two able to opportunistically access spectrum, but may
transmitting powers: -12dBW and 4 dBW. Created in- also aid them in recognizing anomalous or malicious
terfering signal is a pulse signal, created at the same activity by comparing the current state to those stored
frequency as the frequency of the channel used for in their databases. There are three established meth-
communication between radios (225 MHz). Ampli- ods for CRs to acquire knowledge of the spectrum oc-
tude of the created interfering signal varies. The re- cupancy: spectrum sensing (Axell et al., 2012), ge-
sults are presented in figure 12. olocation/database (Gurney et al., 2008), and beacon
BER percentage is shown in the first half of the transmission (Lei and Chin, 2008). HH has a capabil-
Y-axis (0-100), whereas Link quality level stretches ity of performing energy detection spectrum sensing.
throughout the whole Y-axis (0-200). The BER Every 20 seconds, 8192 samples from the ADC
curves are mutually similarly shaped, with the ex- are transmitted over the RS-485 port - this is a func-
pected offset due to differing transmission powers of tionality hard-coded in the HH’s FPGA. Each sample
the radio. The same goes for the link quality curve is transmitted in two bytes: first byte containing the 6
shapes. As can be seen, occurrence of errors at the most significant bits (MSBs), with 2 bits sign exten-
receiving side (area where BER>0) corresponds to sion on the left. Second byte contains the 8 LSBs. In
Link quality levels in the range of [90-120]. As ex- total, 16384 characters are transmitted, making up for
pected, 100% BER corresponds to the link quality of the interpretation of a 16-bit word. Currently, there
0, meaning the communication has become impossi- is not a synchronization pattern - however the idle in-
terval between the two transmissions may be used to threats separately, though, makes for a good starting
e.g. perform analysis of the received data. Transmis- point towards achieving it.
sion of a full window takes approximately 2 minutes. The test bed itself will be embodied with another
The signal at the HH’s FPGA input is a sample HH + power node, with the corresponding auxiliaries,
of raw spectrum. Raw samples are stored in a RAM allowing for examining more complex scenarios and
buffer internal to the FPGA, and output through HH’s creating different network topologies.
fast serial port to the Power node, where they can be Opportunistic spectrum access is inarguably one
processed. of the most exciting features of prospective Cogni-
Due to the high speed of the ADC (250 MHz), se- tive Radio Systems. Building upon the HH’s possibil-
rial port speed (38400 bit/s is supported in the asyn- ity of acquiring the spectrum occupancy information
chronous mode) is not sufficient for the true real- through energy detection, briefly presented in this pa-
time transfer; in addition - processing capabilities of per, we aim at developing algorithms for spectrum in-
the Power node would be completely devoted to the telligence - as the prerequisite for OSA.
processing of received signal, leaving no room for Theoretical foundations for the nSHIELD frame-
higher level applications. Power consumption would work were also described in the paper. How-
be heavily affected as well. ever, common hardware and software interfaces of
Adopted solution is to perform a quasi-real-time SPD-driven Smart Transmission Layer to the upper
acquisition, i.e. to collect a large snapshot of incom- nSHIELD layers - Middleware and Overlay - still
ing spectrum, i.e. tens of kilo-samples, and to transfer need to be decided upon in the future. Also, layers’
the snapshot to the Power node. When the snapshot interdependability will need to be looked into more
has been transferred, a new collection may start. This closely. Hence, for the time being, the nSHIELD
is sufficient for proper analysis of the majority of RF Middleware and Overlay layers are being treated as
scenarios: in practice, only fast pulsed signals might ”black boxes”.
be completely missed.
Future hardware enhancements might make real-
time spectrum acquisition possible. ACKNOWLEDGEMENTS
This work was developed within the nSHIELD
6 CONCLUSIONS AND FUTURE project (http://www.newshield.eu) co-funded by
WORK the ARTEMIS JOINT UNDERTAKING (Sub-
programme SP6) focusing on the research of SPD
The paper has introduced concept and basic premises (Security, Privacy, Dependability) in the context of
of the SPD-driven Smart Transmission Layer, and has Embedded Systems.
described design details of test bed architecture that The authors would like to thank Selex ES and Sis-
will be used for its development, experimentation and temi Intelligenti Integrati Tecnologie (SIIT) for pro-
validation. Several case studies were performed us- viding the equipment for the test bed, and the labora-
ing the test bed, demonstrating its basic capabilities. tory premises for the test bed assembly. Particular ac-
Each of these capabilities needs to be studied and de- knowledgment goes to Virgilio Esposto of Selex ES,
veloped in more detail. Following that, future work for providing expertise and technical assistance.
using the test bed will cover multiple topics, described
as follows.
From the security perspective, the near-future
work will focus on tackling the problems of advanced
and intelligent DoS jamming attacks in CRNs. Us-
ing software packages such as 33503A BenchLink
Waveform Builder Pro in combination with the vec-
tor signal generator, it will be possible to model var-
ious interfering attack strategies, and the appropri-
ate counter-strategies. Because of a variety of pos-
sible attacks and potential security breaches that Soft-
ware Defined Radio and Cognitive Radio technology
bring, provisioning the ultimate security, privacy and
dependability for SDR and CR systems is a challeng-
ing task. Addressing each of the identifiable security
Figure 12: BER and Link quality level vs. interference amplitude of interfering pulse signal.

Figure 13: Link quality level vs. interference amplitude for different interfering signals.
 REFERENCES Lei, Z. and Chin, F. (2008). A reliable and power efficient
beacon structure for cognitive radio systems. Broad-
Arduino (2013). Arduino uno datasheet. http:// casting, IEEE Transactions on, 54(2):182–187.
arduino.cc/en/Main/arduinoBoardUno. Li, H., Amer, P. D., and Chamberlain, S. C. (1995). Es-
Axell, E., Leus, G., Larsson, E., and Poor, H. (2012). Spec- telle specification of mil-std 188-220 datalink layer -
trum sensing for cognitive radio : State-of-the-art and interoperability standard for digital message transfer
recent advances. Signal Processing Magazine, IEEE, device subsystems. In Proceedings of MILCOM ’95.
29(3):101–116. ManageEngine (2013). Mibbrowser free tool faq.
Beagleboard (2013a). Beagleboard system reference man- http://www.manageengine.com/products/
ual. http://beagleboard.org/static/BBSRM_ mibbrowser-free-tool/faq.html.
latest.pdf. Memsic (2013). Memsic iris datasheet. http:
Beagleboard (2013b). Beagleboard xm system refer- //www.memsic.com/userfiles/files/
ence manual. http://beagleboard.org/static/ Datasheets/WSN/IRIS_Datasheet.pdf.
BBxMSRM_latest.pdf. Minden, G., Evans, J., Searl, L., DePardo, D., Petty, V.,
Beagleboard (2013c). Beaglebone system reference Rajbanshi, R., Newman, T., Chen, Q., Weidling, F.,
manual. http://beagleboard.org/static/ Guffey, J., Datla, D., Barker, B., Peck, M., Cordill, B.,
beaglebone/latest/Docs/Hardware/BONE_SRM. Wyglinski, A., and Agah, A. (2007). Kuar: A flexi-
pdf. ble software-defined radio development platform. In
Cabric, D., Tkachenko, A., and Brodersen, R. W. (2006). New Frontiers in Dynamic Spectrum Access Networks,
Experimental study of spectrum sensing based on en- 2007. DySPAN 2007. 2nd IEEE International Sympo-
ergy detection and network cooperation. In Proceed- sium on, pages 428–439.
ings of the first international workshop on Technology Mitola, J. and Maguire, G.Q., J. (1999). Cognitive ra-
and policy for accessing spectrum, TAPAS ’06, New dio: making software radios more personal. Personal
York, NY, USA. ACM. Communications, IEEE, 6(4):13–18.
Dabcevic, K., Marcenaro, L., and Regazzoni, C. S. (2013). Morerio, P., Dabcevic, K., Marcenaro, L., and Regazzoni,
Security in cognitive radio networks. In T. D. Lagkas, C. (2012). Distributed cognitive radio architecture
P. Sarigiannidis, M. L. and Chatzimisios, P., editors, with automatic frequency switching. In Complexity
Evolution of Cognitive Networks and Self-Adaptive in Engineering (COMPENG), 2012, pages 1–4.
Communication Systems, pages 301–333. IGI Global. nSHIELD Consortium (2012). New shield. http://www.
Esposito, M., Fiaschetti, A., and Flammini, F. (2013). The newshield.eu/.
new shield architectural framework. ERCIM News, Rantos, K., Papanikolaou, A., and Manifavas, C. (2013).
2013(93). Ipsec over ieee 802.15.4 for low power and lossy net-
Farrell, R., Sanchez, M., and Corley, G. (2009). Software- works. In Proceedings of the 11th ACM Interna-
defined radio demonstrators: An example and future tional Symposium on Mobility Management and Wire-
trends. Int. J. Digital Multimedia Broadcasting, 2009. less Access, MobiWac ’13, pages 59–64, New York,
Fette, B. A. (2006). Cognitive radio technology. NY, USA. ACM.
Newnes/Elsevier. RaspberryPiFoundation (2013). Raspberry pi home page.
Fiaschetti, A., Suraci, V., and Delli Priscoli, F. (2012). The http://www.raspberrypi.org/.
shield framework: How to control security, privacy SelexES (2013). Swave hh specifica-
and dependability in complex systems. In Complex- tions. http://www.selexelsag.com/
ity in Engineering (COMPENG), 2012, pages 1–4. internet/localization/IPC/media/docs/
Flammini, F., Bologna, S., and Vittorini, V., editors (2011). SWave-Handheld-Radio-v1-2012Selex.pdf.
Computer Safety, Reliability, and Security - 30th In- Tague, P. (2010). Improving anti-jamming capability and
ternational Conference, SAFECOMP 2011, Naples, increasing jamming impact with mobility control. In
Italy, September 19-22, 2011. Proceedings, volume Mobile Adhoc and Sensor Systems (MASS), 2010
6894 of Lecture Notes in Computer Science. Springer. IEEE 7th International Conference on, pages 501–
Fragkiadakis, A., Tragos, E., and Askoxylakis, I. (2013). 506.
A survey on security threats and detection techniques Tkachenko, A., Cabric, D., and Brodersen, R. (2006). Cog-
in cognitive radio networks. Communications Surveys nitive radio experiments using reconfigurable bee2. In
Tutorials, IEEE, 15(1):428–445. Signals, Systems and Computers, 2006. ACSSC ’06.
Gerrigagoitia, K., Uribeetxeberria, R., Zurutuza, U., and Fortieth Asilomar Conference on, pages 2041–2045.
Arenaza, I. (2012). Reputation-based intrusion detec- ZEDBoard (2013). Zedboard quick start.
tion system for wireless sensor networks. In Complex- http://www.zedboard.org/sites/
ity in Engineering (COMPENG), 2012, pages 1–5. default/files/documentations/
Gurney, D., Buchwald, G., Ecklund, L., Kuffner, S., and GSC-AES-Z7EV-7Z020-G-v1f-press.pdf.
Grosspietsch, J. (2008). Geo-location database tech- Zolertia (2013). Zolertia z1 revc datasheet.
niques for incumbent protection in the tv white space. http://zolertia.sourceforge.net/wiki/
In New Frontiers in Dynamic Spectrum Access Net- images/e/e8/Z1_RevC_Datasheet.pdf.
works, 2008. DySPAN 2008. 3rd IEEE Symposium on,
pages 1–9.

View publication stats