Utilizing Pulse Pileup Effect in Development of Robust Low-SNR Covert Communication Links

The additive white Gaussian noise (AWGN) capacity $C$ of a channel operating in the power-limited regime (i.e. when the received signal-to-noise ratio (SNR) is small, ${\rm SNR}\ll 0\,$dB) can be expressed as $C\approx\bar{P}/(N_{0}\,\ln 2)$, where $\bar{P}$ is the average received power and $N_{0}$ is the power spectral density (PSD) of the noise. This capacity is linear in power and insensitive to bandwidth and, therefore, by spreading the average transmitted power of the information-carrying signal over a large frequency band, the average PSD of the signal could be made much smaller than the PSD of the noise. This would “hide” the signal in the channel noise, making the transmission covert and insensitive to narrowband interference.

One of the common ways to achieve such “spreading” is frequency-hopping spread spectrum (FHSS) [1]. This technique is widely used, for example, in legacy military equipment for low-probability-of-intercept (LPI) communications. However, using frequency hopping for covert communications is nearly obsolete today, since modern wideband software-defined radio (SDR) receivers can capture all of the hops and put them back together (J. E. Gilley, personal communication, Feb. 9, 2020).

Another common and widely used spread-spectrum modulation technique is direct-sequence spread spectrum (DSSS) [2]. In DSSS, the narrow-band information-carrying signal of a given power is modulated by a wider-band, unit-power pseudorandom signal known as a spreading sequence. This results in a signal with the same total power but a larger bandwidth, and thus a smaller PSD. After demodulation (“de-spreading”) in the receiver, the original information-carrying signal is restored. However, such demodulation requires a precise synchronization, which is perhaps the most difficult and expensive aspect of a DSSS receiver design. Also, while de-spreading cannot be performed without the knowledge of the spreading sequence by the receiver, the spreading code by itself may not be usable to secure the channel. For example, linear spreading codes are easily decipherable once a short sequential set of chips from the sequence is known. To improve security, it would be desirable to perform a “code hopping” in a manner akin to the frequency hopping. However, synchronization can be an extremely slow process for pseudorandom sequences, especially for large spreading waveforms (long codes), and thus such DSSS code hopping may be difficult to realize in practice.

In this paper, we explore an alternative spread-spectrum approach that, among other appealing features, significantly simplifies and speeds up synchronization and enables on-the-fly link reconfigurability that combines the benefits of both DSSS and FHSS. A simplified explanation of this approach can be given as follows.

In the power-limited regime, we would normally use binary coding and modulation (e.g. binary phase-shift keying (BPSK) or quadrature phase-shift keying (QPSK)) for the narrow-band information-carrying signal, and this signal will be significantly oversampled to enable wideband spreading. Thus an idealized narrow-band information-carrying signal that is to be “spread” can be viewed as a discrete-level signal that is a linear combination of analog Heaviside unit step functions [3] delayed by multiples of the bit duration. Such a signal would have a limited bandwidth and a finite power. Since the derivative of the Heaviside unit step function is the Dirac $\delta$-function [4], the derivative of this idealized signal will be a “pulse train” that is a linear combination of Dirac $\delta$-functions. This pulse train will contain all the information encoded in the discrete-level signal, and it will have infinitely wide bandwidth and infinitely large power. Both the bandwidth and the power can then be reduced to the desired levels by filtering the pulse train with a lowpass filter. If the time-bandwidth product (TBP) of the filter is sufficiently small so that the pulses in the filtered pulse train do not overlap, these pulses will still contain all the intended information.

On the one hand, converting a narrow-band signal into a wideband pulse train has an apparent appeal of no need for “de-spreading”: One can simply obtain samples at the peaks of the pulses to obtain all the information encoded in the signal. On the other hand, at first glance such a pulse train is not suitable for practical communication systems, and especially for covert communications. Indeed, let us consider a pulse train with a given average pulse rate and power. The average PSD of this train can be made arbitrary small, since it is inversely proportional to the bandwidth. However, the peak-to-average power ratio (PAPR) of such a train would be proportional to the bandwidth, making the wideband signal extremely impulsive (super-Gaussian). First, such high crest factor of the pulse train puts a serious burden on the transmitter hardware, potentially making this burden prohibitive (e.g. for ${\rm PAPR}>30\,$dB). Secondly, the high-PAPR structure of a pulse train makes it easily detectable by simple thresholding in the time domain, seemingly making it unsuitable for covert communications. Thirdly, it may appear that sharing the wideband channel by multiple users would require explicit allocation of the pulse arrival times for each sub-channel, which would be impractical in most cases.

Favorably, the temporal and amplitude structure of a pulse train is modifiable by linear filtering, and such filtering can convert a high-PAPR train into a low-PAPR signal, and vice versa. Therefore, such PAPR-modifying filtering enables us to use pulse trains for low-SNR covert communications. As illustrated in Fig. 1, large-TBP pulse shaping in the transmitter can “hide” the pulse train, obscuring its temporal and amplitude structure. It also reduces the PAPR of the signal, making it suitable for transmission. In the receiver, the distinct structure of the pulse train is restored by matched large-TBP filtering, and the high PAPR of the restored pulse train enables low-SNR messaging. To make such a link more robust to outlier interference and to increase the apparent SNR, analog-to-digital conversion in the receiver can be combined with intermittently nonlinear filtering (INF) [5, 6].

The focus of the rest of the paper is on the key components of such a link, and on the synchronous pulse detection in particular. Some of the additional aspects of this approach, such as asynchronous detection, multi-layer and multi-user configurations, and applications for physical-layer steganography and “friendly jamming” are outlined in [7].

A pulse train $p(t)$ is simply a sum of pulses with the same shape (impulse response) $w(t)$, same or different amplitudes $a_{k}$, and distinct arrival times $t_{k}$: $p(t)=\sum_{k}a_{k}w(t-t_{k})$. When the width of the pulses in a train becomes greater than the distance between them, the pulses begin to overlap and interfere with each other. This is illustrated in Fig. 2: For the same arrival times, the pulses in the sequence consisting of the narrow pulses $w(t)$ remain separate, while the wider (more “spread out”) pulses $g(t)$ are “piling up on top of each other.” In this example, $w(t)$ and $g(t)$ have the same spectral content, and thus the PSDs of the pulse sequences are identical. However, the “pileup effect” causes the temporal and amplitude structures of these sequences to be substantially different. For a random pulse train, when the ratio of the bandwidth and the pulse arrival rate becomes significantly smaller than the TBP of a pulse, the pileup effect causes the resulting signal to become effectively Gaussian [8, e.g.], making it impossible to distinguish between the individual pulses.

Indeed, let $\hat{p}(t)$ be an “ideal” pulse train: $\hat{p}(t)=\sum_{k}a_{k}\delta(t-t_{k})$, where $\delta(x)$ is the Dirac $\delta$-function [4]. The moving average of this ideal train in a boxcar window of width $2T$ can be represented by the convolution integral

where $\theta(x)$ is the Heaviside unit step function [3]. At any given time $t_{i}$, the value of $\overline{p}(t_{i})$ is proportional to the sum of $a_{k}$ for the pulses that occur within the interval $[t_{i}\!-\!T,t_{i}\!+\!T]$. Then, if the amplitudes $a_{k}$ and/or the interarrival times $t_{k+1}-t_{k}$ are independent and identically distributed (i.i.d.) random variables with finite mean and variance, it follows from the Central Limit Theorem [9, e.g.] that the distribution of $\overline{p}(t_{i})$ approaches Gaussian for a sufficiently large interval $[-T,T]$.

If we replace the boxcar weighting function in (1) with an arbitrary moving window $w(t)$, then (1) becomes a weighted moving average

which is a “real” pulse train with the impulse response $w(t)$. If $w(t)$ is normalized so that $\int_{-\infty}^{\infty}{\mathrm{d}}{s}\,w(s)=1$, $w(t)$ is an averaging (i.e. lowpass) filter. Then, if $w(t)$ has both the bandwidth and the TBP similar to that of the boxcar pulse of width $2T$, the distribution of $p(t_{i})$ would be similar to that of $\overline{p}(t_{i})$ (e.g. Gaussian for a sufficiently large $T$).

Having demonstrated how the information-carrying pulse train can be made transmittable and covert, we shall discuss how the message can be best recovered in the receiver.

To enable synchronous detection for a train $x[k]$ with the pulses separated by $N_{\rm p}$ samples, the following modulo power averaging (MPA) function can be constructed as an exponentially decaying average of the instantaneous signal power $x^{2}[k]$ in a window of size $N_{\rm p}\!+\!1$:

where $k_{j}$ is the sample index of the $j$-th pulse, and ${M\!>\!1}$. In (9), the double square brackets denote the Iverson bracket [12]

where $P$ is a statement that can be true or false. Thus the window $k_{j\!-\!1}\!-\!N_{\rm p}\!\leq\!k\!\leq\!k_{j\!-\!1}$ includes two transmitted pulses, $k_{j\!-\!2}$ and $k_{j\!-\!1}$, and the index $i$ in $\bar{\rm p}[i;k_{j\!-\!1},M]$ takes the values $i=0,\ldots,N_{\rm p}\!-\!1$. Note that using exponentially decaying average in (9) would roughly correspond to averaging $N\!=\!2M\!-\!1$ of such windows. The exponentially decaying average, however, has the advantage of lower computational and memory burden, especially for large $M$, and faster adaptability to dynamically changing conditions.

For a sufficiently large $M$, the peak in $\bar{\rm p}[i;k_{j\!-\!1},M]$ corresponding to the pulses of the pulse train will dominate. Therefore, the index $k_{j}$ for sampling of the $j$-th pulse can be obtained as

where $i_{\rm max}$ is given implicitly by

Fig. 7 illustrates this synchronization procedure. The MPA function shown in the right-hand side of the figure is computed according to (9). To emphasize the robustness of this synchronization technique even when the bit error rates are very high, the SNR is chosen to be respectively low (${\rm SNR}=-20\,$dB, ${\rm BER}\approx 1/3$).

For the link shown in Fig. 1, Fig. 8 compares the calculated (dashed lines) and the simulated (dots connected by solid lines) BERs, for the “ideal” synchronization (black dots), and for the synchronization with the MPA function described above. The AWGN noise is added at the receiver input, and the SNR is calculated at the output of the matched filter in the receiver. One can see that for ${M\!=\!2}$ (red dots) the errors in synchronization are relatively high, which increases the overall BER, but the MPA function with ${M\!=\!8}$ (blue dots) provides reliable yet still fast synchronization. The BERs and the respective SNRs in Fig. 8 are presented for the pulse repetition rates indicated by the vertical dashed lines in Fig. 6.

Gaining control over the temporal and amplitude structures of the signals in the transmitter and the receiver, especially when combined with nonlinear filtering techniques such as INF [7], opens up intriguing opportunities in various spectrum sharing and coexistence applications. For example, as schematically illustrated in Fig. 11, the main message may be transmitted using one of the existing communication protocols (e.g. OFDM), but its temporal and amplitude structure can be obscured by employing a large-TBP filter in the transmitter, e.g., made to be effectively Gaussian. This alone enhances security of the transmission, since the intersymbol interference becomes excessively large and the signal cannot be recovered in the receiver without knowing the pulse shaping filter. Further, a jamming pulse train, disguised as Gaussian by a different large-TBP filter, can be added to the main signal. This jamming signal can have the same spectral content as the main signal, and its power can be sufficiently large (e.g. similar to the main signal) so that the main signal is unrecoverable even if the first pulse shaping filter is known. In the receiver, the jamming pulse train is removed from the mixture by an INF (and decoded, if it itself contains information), enabling the subsequent recovery of the main message without loosing its quality.

Even a simple single-channel link that is the focus of this paper (see Fig. 1) provides appealing practical applications. For example, an existing channel (say, a voice channel in a two-way radio) can be converted into a low-power, lower-rate (say, text) covert channel operating at the same range. This can be accomplished without significant hardware redesign, by modifying only the digital signal processing in both transmitter and the receiver. Alternatively, when transmitted at the original power, such a lower-rate, lower-SNR channel can extend (say, quadruple) the range of the link.

In a broader context, the approach outlined in this paper allows for many practical variations, ranging from simple and easily implementable to more elaborate, highly secure multi-level configurations that would require addressing additional conceptual and implementational challenges.

The authors would like to thank James E. Gilley of BK Technologies, West Melbourne, FL; Arlie Stonestreet  II of Ultra Electronics ICE, Manhattan, KS, and Kyle D. Tidball of Textron Aviation, Wichita, KS, for their valuable suggestions and critical comments. This work was supported in part by Pizzi Inc., Denton, TX 76205 USA.