# A real-time interception system for compromised frequency-hopping signal eavesdropping

Coretin Lavaud, Robin Gerzaguet, Matthieu Gautier, Olivier Berder, Erwan

Nogues, Stephane Molton

► To cite this version:

Coretin Lavaud, Robin Gerzaguet, Matthieu Gautier, Olivier Berder, Erwan Nogues, et al.. A real-time interception system for compromised frequency-hopping signal eavesdropping. Microprocessors and Microsystems: Embedded Hardware Design, 2025, 113, 10.1016/j.micpro.2025.105144. hal-04979209

HAL Id: hal-04979209

https://inria.hal.science/hal-04979209v1

Submitted on 6 Mar 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

# A real-time interception system for compromised frequency-hopping signal eavesdropping

Corentin Lavaud<sup>a</sup>, Robin Gerzaguet<sup>a</sup>, Matthieu Gautier<sup>a, *,</sup> Olivier Berder<sup>a</sup>, Erwan Nogues<sup>b</sup>,
Stephane Molton<sup>b</sup>

<figure><img src="image_3.png" /></figure>

## ARTICLE INFO

Keywords:

Side-channel
Hardware/software architecture
Frequency-hopping
Software-defined radio

## ABSTRACT

In modern computing architectures, sensitive data (red data) is carried out in the same processing units as encrypted data (black data). Due to leaks (internal mixing, coupling ...), this red data can be emitted in a legitimate radio transmission through a so-called telecom side-channel. This new type of side-channel creates an important threat as it can be passively and remotely processed by a dedicated interception system. This threat becomes even more concerning within the context of the Internet of Things, as the use of low-cost components leads to increased leaks. This paper addresses telecom side-channels on frequency-hopping signals, that are harsh to eavesdrop due to their sporadic nature in both time and frequency domains. To that goal, a wideband interception system is proposed, able to intercept frequency-hopping signals in real time and to extract sensitive red data from it. The system relies on software-defined radios and leverages both hardware and software resources to process a 200 MHz bandwidth in real time. The proposed architecture is capable of detecting jumps on the order of 20 µs and can therefore track 50,000 jumps per second across 1,024 channels. Finally, the criticality of telecom side-channels in Bluetooth communications is demonstrated through real interception on several microcontroller chips.

## 1. Introduction

In recent decades, organizations, firms, states and administrations have sought to become more efficient and productive by adopting computer technologies, thus engaging in the process of digital transformation. However, such large-scale deployment of digital technologies has paved the way to new types of threats. Confidential data may be carried within the same system as ordinary content, blurring the boundary between the sensitive and non-sensitive areas and leading to potentially malicious security breaches.

Hence, security of information systems has become a critical challenge at multiple scales with strategic interests for protection (defense) and interception (attack). One of the most common ways to protect data is to encrypt them: encrypted data is also qualified as *black data* in opposition to non-encrypted data, the *red data*. To prevent any compromise, red data should not be emitted or accessed (in any way) from outside. The reasons of this non-encryption may be diverse: either encrypting is not possible, occurs later or seems unnecessary as data is (theoretically) confined [1].

With the massive deployment of IoT (Internet of Things), the issue of data security within such networks is prominent. While one can argue for the non-criticality of many IoT applications, some of these networks require strong integrity. One way to ensure robust protection is to secure transmission in addition to encryption [2]. Among the large list of potential threats for such networks, TEMPEST is one of the most problematic scenarios: it occurs when red data is un-intentionally emitted due to the presence of a non-legitimate channel. This channel may have different nature (light, sound, or Electro-Magnetic (EM)) and due to different causes (EM leakage, coupling, air-gap bridging...) [3].

The criticality of a side-channel is intrinsically linked to its menace index i.e. the capacity to conduct an eavesdrop and to successfully recover a red signal without being noticed. EM side-channel exhibits a very high menace index: as EM waves pass through walls, the side-channel can be detected without being close to the targeted leaking device [4]. This article focuses on telecom side-channel and we aim to demonstrate that its criticality is underestimated in some scenarios.

Since the last few years, many exploits have targeted EM side-channels [3] and it has recently been shown that regular wireless

<footnote><sup>a</sup> Univ Rennes, CNRS, IRISA, France</footnote>

<footnote><sup>b</sup> DGA-MI, France</footnote>

<footnote>* Corresponding author.</footnote>

<footnote>E-mail addresses: corentin.lavaud@irisa.fr (C. Lavaud), robin.gerzaguet@irisa.fr (R. Gerzaguet), Matthieu.gautier@irisa.fr (M. Gautier), olivier.berder@irisa.fr (O. Berder), erwan.nogues@intradef.gouv.fr (E. Nogues), stephane.molton@intradef.gouv.fr (S. Molton).</footnote>
<figure><img src="image_4.png" /><figcaption>Fig. 1. TEMPEST scenario with telecom side-channel.</figcaption></figure>

transmissions (e.g. Wi-Fi or Bluetooth) can hide a side-channel [5]. This increases the range of the compromise as the red signal is carried by the black signal and its menace index is therefore greatly enhanced. Such scenario, called telecom side-channel, is described in Fig. 1: a red sensitive data is present in the black data transmission between two devices and could therefore be eavesdropped by a malicious interception system.

A key element of such telecom side-channel is how the red signal can be intercepted: if in the past, such eavesdrops required specific high cost specialized materials and devices, low cost flexible and computational efficient architectures can now capture EM waves and extract the information: Software-Defined Radios (SDR) [6].

In a telecom side-channel, recovering the red signal implies to be able to detect the black signal. This can be tricky especially for Frequency-Hopping (FH) signals. FH is a method of transmitting radio signals by changing the carrier frequency among many distinct frequencies occupying consequently a large spectral band. The change, or hop sequence, of the FH channels is known by both the transmitter and receiver and is usually generated with a pseudo random generator [7]. FH transmission is used in the well-known Bluetooth transmission but it is also proposed in the transmission security (TRANSEC) system which defines security measures for both tactical wireless transmissions [8] and IoT transmissions [2]. This is the scenario we focus on and the target use-case corresponds to an audio signal (i.e. the red one) carried by a TRANSEC or Bluetooth carrier (i.e. the black signal) due to, for instance, the physical proximity between a microphone and a turned on transmitter.

FH-based telecom side-channel has been few addressed in the literature: [5,9] used a simplified version of FH signal to extract information while [10] did not extract any red information. Other articles focusing on red signal extraction [11,12] do not place much emphasis on the real-time retrieval of FH signals. Indeed, the interception of FH signals in the TEMPEST scenario still faces several challenges: (i) the hop sequence can be very long and even impossible to predict as in TRANSEC case and the solution proposed in this paper is therefore to detect the used channel in real time, (ii) the transmission bandwidth can be very large (e.g. 80 MHz for Bluetooth case) making the real time interception difficult or costly, SDR approach with FPGA-based hardware (HW) accelerators could tackle such an issue, (iii) the extraction of the red signal is demonstrated in this paper with a proof-of-concept of eavesdrops on real Bluetooth dongles, showing for the first time the vulnerability of such devices.

To tackle such challenges, the main contributions of this work are:

* Black FH signal detection and red audio signal extraction: a FH tracking algorithm based on a frequency analysis is proposed to address short hop duration. For red signal extraction, the novelty relies on the envelope extraction of the main frequency bin which allows audio recovering.

* Hardware implementation of a real-time and flexible system: a specific system has been implemented leveraging SDR technology. The proposed methodology optimizes both HW resource with FPGA acceleration to target large bandwidths (up to 200 MHz) and flexible software (SW) resource to address different kinds of red signal.

* Demonstration of real eavesdropping: side-channel interception on commercial Bluetooth dongles has been realized. A tone frequency has been remotely recovered in real time by tracking the FH Bluetooth signal with our interception system. These experiments show the criticality of such telecom side-channel for the tested IoT dongles.

The rest of this paper is organized as follows. In Section 2, related works on telecom side-channels on the one hand and FH interception systems on the other hand, are presented. After FH model is introduced, Section 3 is devoted to our interception method and a first performance evaluation in terms of channel error rate is presented. The HW/SW partitioning methodology and the architecture of the real-time interception system are detailed in Section 4. Finally, the recovery of a passive audio leak and pulse is demonstrated in Section 5 to validate our approach, before some conclusions are drawn in Section 6.

## 2. Related works

### 2.1. Telecom side-channels

Telecom side-channels have been firstly studied as the disturbance of the propagation channel of Radio Frequency (RF) signals by external red signals (mainly audio signals) [13–15]. In recent years, new types of telecom side-channel have appeared with the advent of System-on-Chip (SoC) [5,13,16,17].

Speakers are widely used in conference systems and may, by their nature, carry confidential information. Soundproof walls are generally used as a countermeasure against sound leaks. However, it is still possible to recover sound from outside such secured rooms, not by using sound generated by the loudspeaker, but the small disturbances it causes to RF signals in its environment [13,15]. Using RF waves has the advantage of not requiring a perfect line of sight with the loudspeaker or physical access to the secured room. As with other leaks [3], Amplitude Modulation (AM) is performed between the sound and the external RF signal. Signals disturbed by the loudspeaker may come from different sources. First, they may originate from an attacker. In such a scenario, the attacker is able to fully control the interception parameters and choose a frequency that allows the best signal recovery. In addition, it is not necessary to continuously transmit: signal bursts can be used since the voice can be sampled at a low frequency and still be perfectly intelligible. Another approach of radio illumination is the use of RF signals that are already present to intercept the sound signal. For example, this is the case of Wi-Fi waves [13] that are most of the time present in conference rooms. This naturally increases the range of compromising RF waves, allowing potential interception even at a great distance from the loudspeaker.

With the recent advent of SoC, processors, memories and radio communication circuits can be combined on the same circuit to create smaller and cheaper devices. Although these systems are mainly made up of digital components, an analog part still remains for power supply and communications. While modern radio protocols are digital and most of their layers are implemented in the digital domain, the generation, amplification, and transmission of RF signals are by nature analog operations. Fig. 2 details the scenario of a telecom side-channel in a SoC. For any subpart of the latter, the potential leak can occur due to an interaction with the transceiver either by a common power supply (blue arrow) or by a direct coupling (violet arrow).

The recovery of encryption keys through an analysis of various emulations of a processor or power supply has been widely studied [18,19].
<figure><img src="image_5.png" /><figcaption>Fig. 2. Potential telecom side-channels in a SoC. The arrows correspond to the leak hypothesis: directly with the radio transceiver (violet arrow) or via the power supply (blue arrow). (For interpretation of the references to color in this figure legend, the reader is referred to the web version of this article.)</figcaption></figure>

However, all these methods use probes that must be placed very close to the component being studied, which limits the criticality of the threat. In a system where a SoC used encryption, a shared power supply between the processor and the radio circuit, on the one hand, and physical proximity, on the other hand, may both result in the presence of processor activity on the transmitted radio signals. If, during a radio communication phase, the processor performs encryption (which is very common as secure radio exchange packets are encrypted on the fly), processor activity may then be present in the RF signal. Therefore, it is possible to remotely recover the encryption key by listening to the radio communication [17]. This effect will be even more pronounced with the use of low-cost SoC in IoT devices. For instance, Camurati et al. presented a successful attack of this kind [5]. The target was a SoC nRF52832 that embeds both a Bluetooth transceiver and an Advanced Encryption Standard (AES) accelerator. They showed that it is possible to retrieve the AES encryption key at a distance of 10 m with methods very similar to EM analysis [20].

Most of these studies focus on permanent emanation side-channels in which the RF signal is continuously transmitted at a constant frequency. This eases the interception as most of the state-of-the-art detection and estimation algorithms rely on averaging in order to better estimate the data. Some articles focus on sporadic channels in time or frequency, but either by maintaining the frequency constant or by lowering the number of hops per second [5,13]. The key achievement of this paper is therefore to propose a wideband interception system able to eavesdrop telecom side-channels based on frequency-hopping signals.

## 2.2. Frequency-hopping interception systems

FH signals are defined by their number of channels $N$ and the number of hops per second that defines the hop duration $T_s$. Our objective is the continuous observation, detection and extraction of FH signals over a wide band $F_c$ (> 100 MHz) and the analysis of the presence of an internal side-channel. The nature and parameters of the FH signal being unknown, the method to be used should not resort to a priori data. The state-of-the-art of such wideband and blind detection relies on a Discrete Fourier Transform (DFT) of size $N$ analysis followed by an energy detector of each DFT tap [21,22].

In addition to detecting frequency-hopping channels, the interception system must also extract the information within the identified channel. Such a system has been proposed in [23] and the different steps are shown in Fig. 3. The large bandwidth $F_c$ is processed in order to extract the estimated channel $\hat{p}$ that has a bandwidth $F_b$ such that $F_c = NF_b$. Finally, processing at red signal rate $F_r$ is performed to extract compromise.

<figure><img src="image_6.png" /><figcaption>Fig. 3. DFT-based multi-channel detection algorithm.</figcaption></figure>

# 3. Interception algorithm for frequency-hopping signals

## 3.1. Telecom side-channel and frequency-hopping models

A side-channel signal is the mixture of a regular data (black signal) with a confidential illegitimate data (red signal) and can be modeled in several ways depending on its source. In this study, we consider that the black signal carrier frequency follows a frequency-hopping pattern and the red signal of bandwidth $F_r$ is combined with the black signal (baseband) of bandwidth $F_b$ (with $F_b \gg F_r$) in an additive way. This model corresponds to a large majority of observed TEMPEST side-channels [3]. The mixing with the black signal is proportional with the factor $h$:

$$b(t) = b_b(t) + h \times r(t), \quad (1)$$

where a baseband message $b_b$ (e.g. TRANSEC or Bluetooth) is considered. This message carries no usable sensitive data and is called a black signal, but through a side-channel, a red signal $r(t)$ can be mixed within the black signal with (1). The baseband message $b(t)$ is then modulated following the FH sequence, resulting in a $F_c$ bandwidth transmitted signal:

$$x(t) = b(t)e^{2j\pi(f_0+f_p(t))t}\alpha_{T_s}(t) \quad (2)$$

with $f_0$ the lower carrier frequency, $f_p(t)$ the channel frequency associated to transmitted symbols of $b(t)$, $p$ the channel index, and $\alpha_{T_s}$ the sporadicity factor expressing whether the transmission occurs:

$$\alpha_{T_s}(t) = \begin{cases} 1 & \text{if transmission,} \\ 0 & \text{otherwise.} \end{cases} \quad (3)$$

Assuming that $N$ evenly distributed channels can be used, a time slot $T_w$ corresponds to the duration of $N$ samples sampled at $T_c = 1/F_c$ (i.e. $T_w = NT_c$). It is the minimal duration where the channel index $p$ cannot change. The instantaneous frequency $f_p(t)$ can be expressed as:

$$f_p(t) = \sum_{k=-\infty}^{+\infty} p[k] \times \frac{F_c}{N} \times \Pi_{T_w}(t - kT_w), \quad (4)$$

where $p[k] \in [0; N-1]$ is the channel index occupied in slot $k$ and $\Pi_{T_w}(t)$ the gate function that is equal to 1 if $t \in [0, T_w[$ and 0 elsewhere. Note that in most FH standards, the same channel index $p[k]$ is maintained constant for $\lambda$ consecutive time slots which define the so-called hop duration $T_s = \lambda T_w$. In the following, the received signal $d(t)$ is the transmitted signal only affected by a fading factor $\gamma$, a propagation delay $\tau$ and impaired by an Additive White Gaussian Noise (AWGN) $w(t)$ of variance $\sigma_w^2$ and is therefore expressed as:

$$d(t) = \gamma x(t - \tau) + w(t). \quad (5)$$

This signal is emitted through electromagnetic waves at the FH standard carrier frequency (e.g. 2.4 GHz for Bluetooth) and is retrieved by the real-time interception system as depicted in Fig. 1. The signal $d$ is sampled at the maximal rate $F_c$ defining therefore $d[u] = d(uT_c)$.

## 3.2. FFT-bin extractor algorithm

The detector initially proposed in [23] and described in Section 2.2 faces significant limitations due to its high computational complexity, which hinders its implementation in hardware for high data rates.
<figure><img src="image_7.png" /><figcaption>Fig. 4. FFT-BE algorithm.</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>Fig. 5. CER for different FH configurations.</figcaption></figure>

Additionally, the original design relies on perfect knowledge of parameters such as the number of channels N and the averaging factor $\lambda$, necessitating precise time-domain synchronization. To address these challenges, we propose two modifications that will greatly alleviate the computational complexity while only slightly affecting the detection performance. The first modification aims to force the channel size and the second is to remove the synchronized averaging process. Considering the kth time slot, the initial detector is expressed as:

$$ \hat{p}_{\text{old}}[k] = \arg \max_{p \in \{0; N-1\}} \left\{ \sum_{l=0}^{\lambda-1} \left| \sum_{m=0}^{N-1} d[k\lambda N + lN + m]ke^{-\frac{2j\pi mp}{N}} \right|^2 \right\}. \quad (6) $$

This detection is very sensitive to time shifts and we propose to reduce the complexity of the proposal by:

* using a Fast Fourier Transform (FFT) of size $N_{FFT}$, a power of 2, instead of a DFT of size N (with $N_{FFT} > N$). It allows efficient implementation of the FFT in hardware and makes the architecture more generic as it does not require a perfect alignment with the effective number of channels. A window of size $N_{FFT}$ samples will be therefore processed instead of a synchronized time slot of N samples.

* not applying the averaging factor $\lambda$ as this parameter may be unknown in most TRANSEC cases. It means that each window capture will be independent from others which will limit error propagation in the channel detector. It will be at the price of a degradation in Signal-to-Noise Ratio (SNR) as discussed in the next part.

The novel channel detector for the kth processed window can be expressed as:

$$ \hat{p}[k] = \arg \max_{p \in \{0; N_{FFT}-1\}} \left\{ \left| \sum_{m=0}^{N_{FFT}-1} d[kN_{FFT} + m]e^{-\frac{2j\pi mp}{N_{FFT}}} \right|^2 \right\}. \quad (7) $$

The second contribution is on the channel extractor. In the initial proposal, the detector and the channel extractor were independent

<table><caption>Table 1
Considered FH parameters.</caption><thead><tr><th></th><th>Number of channels N</th><th>Repetition factor λ</th><th>Hop duration T<sub>s</sub> (μs)</th></tr></thead><tbody><tr><td>BLE</td><td>40</td><td>1 250</td><td>625</td></tr><tr><td>TRANSEC</td><td>40</td><td>400</td><td>200</td></tr><tr><td>Fast-TRANSEC (FT)</td><td>40</td><td>40</td><td>20</td></tr></tbody></table>

as shown in Fig. 3. The latter takes the detected channel $\hat{p}_{old}[k]$ and performs a de-rotation by multiplying the received time slot of $\lambda \times N$ samples by $e^{-2j\pi s\hat{p}_{old}[k]/N}$ with $s \in [0; \lambda N - 1]$. In a second step, specific red signal extraction is applied (low pass filtering, AM demodulation, ...).

We propose to combine the detector and the channel extractor into a single algorithm called FFT-Bin Extractor (FFT-BE). The square magnitude of the FFT is used to find both the channel index $\hat{p}[k]$ and its envelope expressed as:

$$ \hat{d}_{\hat{p}[k]}[k] = \left| \sum_{m=0}^{N_{FFT}-1} d[kN_{FFT} + m]e^{-\frac{2j\pi m\hat{p}[k]}{N_{FFT}}} \right|^2. \quad (8) $$

Eq. (8) corresponds to the AM demodulation of Eq. (2) combined with the mixing signal model in Eq. (1), under the condition that the width of the extracted channel $F_c/N_{FFT}$ is greater than the bandwidth of the red channel $F_r$. Eqs. (7) and (8) rely on a single computation of the FFT for the current window which greatly reduces the complexity of the detection algorithm as shown in Fig. 4. It is to note that the proposed FFT-BE algorithm leads to a down-conversion as we compute only one output for a window of $N_{FFT}$ elements. The larger $N_{FFT}$ with respect to N, the more stringent the down-conversion.

### 3.3. Channel error rate

The performance of the proposed detector is evaluated and compared with the initial algorithm [23] in an ideal receiving case. As the core contribution is to simplify the architecture to be able to implement it in real time, the complexity reduction will lead to a performance penalty with respect to the initial algorithm. Performance is evaluated in terms of Channel Error Rate (CER) defined as the probability that the estimated channel index $\hat{p}$ differs from the effective channel index p. The baseband model defined in (1) is considered for which $b_p$ follows a Gaussian Frequency Shift Keying (GFSK) modulation with modulation index of 0.5 as used in Bluetooth Low Energy (BLE). The CER is computed for several values of SNR defined from (5) as $\gamma^2 P_b/\sigma_w^2$ with $P_b$ the power of the side-channel signal defined in (1) and with no temporal sporadicity (e.g. $\alpha_{Ts}(t) = 1$). A same bandwidth of 40 MHz and different hop durations are considered. The parameters are summarized in Table 1. The first configuration corresponds to BLE [24]. The second configuration mirrors a classic TRANSEC system [8] with a hop duration divided by three with respect to BLE. The last configuration, denoted FT for Fast-TRANSEC, corresponds to a very short hop duration. The latter configuration leads to the stringent synchronization requirement. The parameters (hop duration and bandwidth) are compatible with the Vector Signal Analyzer (VSG) used in Section 4.4.

Fig. 5 shows the CER achieved by the two algorithms for the different configurations. For [23] the FFT size matches the number of FH channels for each configuration whereas for FFT-BE the FFT size is fixed to 1024 for all configurations. The proposed method exhibits two drawbacks. First, the absence of averaging leads to an SNR penalty (around 9 dB for a target CER of $10^{-1}$). This penalty will have a strong impact for scenarios in which sensitivity really matters but will not be an issue in many eavesdrop cases where strong SNR are encountered (e.g. line of sight case). The second issue is the plateau phenomenon at a high CER level encountered by FT case. This is due to the mismatch between the detector parameters and the standard ones. Note that in [23], both perfect synchronization and perfect knowledge of FH
<figure><img src="image_9.png" /><figcaption>**Fig. 6.** Proposed implementation scheme. The color arrows correspond to the different types of signals that pass from a block to another. (For interpretation of the references to color in this figure legend, the reader is referred to the web version of this article.)</figcaption></figure>

parameters (number of channels, hop duration) are assumed which is not guaranteed in practice. It means that this performance penalty will be lower in a practical eavesdrop.

# 4. Real-time implementation leveraging SDR

## 4.1. Proposed methodology and platform description

The FH detector uses the total FH bandwidth $F_c$ to track the frequency hops while BE algorithm extracts a narrow band for the red signal processing unit. It means that (i) real-time constraints are stringent for the FH detector and bin extractor while (ii) flexibility is desired for the red signal extraction to adapt the algorithms to the nature of targeted eavesdrop.

To achieve such requirements, the proposed system has been deployed on the Universal Software Radio Peripheral (USRP) X310 SDR from Ettus Research and a host computer. Such SDR allows a large signal acquisition of 200 MHz bandwidth and embeds FPGA acceleration capabilities. To process such 200 MHz bandwidth in real time using the FFT-BE algorithm described in Fig. 4, the implementation methodology leverages both HW and SW computing resources.

An Field-Programmable Gate Array (FPGA)-based acceleration is used for the FH detection and the bin extraction. As a USRP X310 is used, the Intellectual Property (IP) blocks have been integrated using RFNoC framework [25]. RFNoC also manages the acquisition of the radio signal. The red signal processing unit has been implemented by the SW means of the host computer. The SW implementation is performed with the Julia language that offers both a high-level description of the algorithm (close to Python) and an efficient implementation (close to C/C++) [26]. Moreover, we have proposed an ecosystem described in [27] for managing the interface with the USRP X310.

## 4.2. HW/SW partitioning

The proposed HW/SW partitioning is depicted in Fig. 6. The FH detector based on FFT is clearly visible as well as the bin extractor. The total received energy $e[k]$ is also computed to detect the time domain sporadicity. In the bin extractor, the energy at the detected channel $\hat{d}_{\hat{\rho}[k]}[k]$ is computed as well as the one of the previous detected channel $\hat{d}_{\hat{\rho}[k-1]}[k]$. This increases the robustness of the detection. Our architecture provides thus four outputs for each processed window: the total energy $e[k]$, the chosen channel index $\hat{p}[k]$, the envelope at this channel index $\hat{d}_{\hat{\rho}[k]}[k]$ and the envelope at the previous channel index $\hat{d}_{\hat{\rho}[k-1]}[k]$. The throughput of the hardware design is $4 \times F_c / N_{FFT}$ and is

<table><caption>**Table 2**
Resource utilization on a Kintex 7-410T.</caption><thead><tr><th></th><th>Total LUT</th><th>DSP48 blocks</th><th>Logic cell</th></tr></thead><tbody><tr><td>FH detector</td><td>5823 (5.22%)</td><td>52 (3.37%)</td><td>21,047 (8.68%)</td></tr><tr><td>Bin extractor</td><td>7732 (6.93%)</td><td>0 (0%)</td><td>37,766 (14.74%)</td></tr><tr><td>Total Design</td><td>111,582 (43.90%)</td><td>245 (15.91%)</td><td>242,610 (59.65%)</td></tr></tbody></table>

serialized and fed to the red signal processing unit in software.

At SW side, our open source Julia wrapper, AbstractSDRs [27], is used to configure the radio and desynchronize the four outputs for each processed window. The first stage is a sporadicity detector. If the received energy $e[k]$ is below a pre-defined threshold, the signal $\hat{d}_{\hat{\rho}[k]}[k]$ is forced to 0. The second step is to detect a potential artifact in the detected channel sequence. If C windows in past neighborhood and C windows in future neighborhood of the current window K have the same detected channel index $\hat{p}[k-1]$ and that $\hat{p}[k] \neq \hat{p}[k-1]$, then we use the envelope at the previous detected channel $\hat{d}_{\hat{\rho}[k-1]}[k]$ instead of $\hat{d}_{\hat{\rho}[k]}[k]$. This artifact correction allows to correct an undesired channel change during a hop. It will be at the price of a negligible latency of $C \times N_{FFT}$ samples. The value of C depends on the hop duration and has been set to 2 for the BLE case. It eventually leads to 25 µs latency penalty.

The last stage corresponds to the low-pass filtering to go down to the red signal bandwidth $F_r$. In our audio case, this value is set to 8 kHz but it can be on-the-fly updated due to the flexibility of software processing.

## 4.3. Hardware acceleration with FPGA

The HW processing of Fig. 6 has been implemented in the Kintex 7-410T FPGA embedded in the X310 SDR. The HW map of the FPGA is shown in Fig. 7 and the resource used by our design is given in Table 2. In Fig. 7, the different processing units are clearly visible. Most of the synthesized blocks are IPs from Xilinx or RFNoC [25]. Two radios front-ends (in purple) are synthesized even if our application only uses Radio-0. The digital front-end with down-conversion and filtering is depicted in light green and denoted as DDC (Digital Down Converter). The interface between the X310 and the host PC for red signal processing is visible in dark green with an SFPP interface. Different configurations and control interfaces are visible (light red on top, AXI wrapper in dark red, UHD in cyan, XBAR in red and blue) have also been synthesized to ensure configurability from the host PC. Large memory areas have been instantiated on right hand corner in purple and blue (DMA FIFO and RAM) to store the IQ samples.
<figure><img src="image_10.png" /><figcaption>Fig. 7. FPGA hardware map.</figcaption></figure>

The resource used by the two processing blocks (FH detector and bin extractor) are given in Table 2 as well as the resource of the total design. The percentage of the total FPGA resource is given in brackets. While the total design uses almost half of the FPGA resource, our two processing blocks do not represent the largest part of the design. This is due to the overlay provided by Ettus with UHD and RFNoC as well as the interconnects.

## 4.4. Validation of hardware architecture

To ensure the proper functioning of the different parts of the interception system, a controlled FH signal is firstly generated with a VSG. The FH sequence follows a frequency sweep with various hop durations and with $F_c = 40$ MHz centered at 2.4 GHz. The VSG is connected to the X310 with a cable and no additional noise is added. The VSG Tx output power varies from -75 to 0 dBm. On the radio side, a 30 dB attenuator is used and the X310 receiving gain has been set to 6 dB.

The first test consists in ensuring that a correct channel is detected, Fig. 8 shows CER metric as a function of the VSG transmit output power. Due to VSG limitation, both a constant number of channels and a constant bandwidth are used and the CER is computed for different hop durations following the configurations described in Table 1 and used in Fig. 5. We can see the presence of different plateaus as the receiving system is not synchronized with the emitter and that the performance achieved by our real-time interception system is really close to the one obtained in simulation. It proves the correctness of our HW/SW implementation.

A second test has been conducted to ensure that our architecture is able to process the 200 MHz bandwidth. Due to the limitation of the

<figure><img src="image_11.png" /><figcaption>Fig. 8. CER vs VSG Tx output power for the three configurations of Table 1.</figcaption></figure>

VSG, the transmitted signal is still 40 MHz wide but the X310 bandwidth has been set to 200 MHz centered at 2.4 GHz carrier frequency. The same performance as Fig. 5 has been observed with only 205 of 1024 active channels as 20% of the 200 MHz bandwidth is used by the FH system.

One can conclude that the proposed algorithm gives satisfactory detection performance for a hop duration greater than 20 µs. It means that the architecture is capable to track 50000 hops per seconds with a maximum of 1024 FH channels.

# 5. Demonstration of real eavesdrops

The purposes of these experiments are to show how BLE devices can lead to information compromises and how the proposed interception system can recover red signal information.

## 5.1. Methods and metrics

Based on leak hypothesis described in Fig. 2, we have tried to force leaks at different places in a SoC with BLE and observed to what extent it is conceivable to induce a side-channel and if our interception system is able to recover it.

**Experimental setup:** In these experiments, commercially available FH sources will be used, namely BLE dongles, which will be set in BLE beacon mode, i.e., they will periodically emit a BLE signal. These dongles (ESP32 and nRF52832) allow a wired connection to the SDR so that the SDR only listens to the signal from the dongle. Using commercial BLE dongles, it is no longer possible to know the hop sequence and thus no CER is available.

BLE devices are not modified and compromise has not been forced by an external mean. The leaks will come from the devices themselves due to their operating behavior. In order to detect a compromise, we have programmed the dongle to perform (in addition to their BLE beacon task) common tasks such as reading an audio stream, flashing LED or acquiring an analog signal and the outgoing BLE signal through our interception system has been observed. We will look if the characteristic frequency (red signal) of the tasks is present in the BLE signal. To that goal, we will set these characteristic frequencies to 1000 Hz for nRF52832 dongle and to 1250 Hz for ESP32 one. Two experiments are detailed in the following: the starting one is a full setup of an audio stream broadcast from the dongle and the simplest one implies just a PWM (Pulse Width Modulation) operating.

**Red signal observation:** To highlight the presence of the characteristic frequencies, spectral analysis must be performed. However, BLE signal from dongle is strongly sporadic (e.g. 1.7% of duty-cycling ratio for
<figure><img src="image_12.png" /><figcaption>Fig. 9. Setup for side-channel checking issued from an audio system subpart.</figcaption></figure>

<figure><img src="image_13.png" /></figure>

nRF52832 one). Thus, analyzing the red signal spectrum with a periodogram on a large time acquisition will be quite cumbersome and inaccurate if the red signal has a very low amplitude. The spectral analysis is therefore performed only on the useful part of FFT-BE outputs. This step is managed by the sporadicity detector introduced in the previous section (see Fig. 6).

Moreover, to further improve the analysis when the leakage is intentionally generated, a *Spectrum difference* is realized, i.e., the algorithm is executed on a signal where a compromise is supposed to be present (or at least forced) and on another one where the studied compromise is not supposed to exist. The two signal acquisitions are executed one after the other, with the same material in the same positions to ensure that only the difference due to the leakage appears on the figure and not the influence of the environment or how the signal is observed.

## 5.2. Audio recovering

This first experiment illustrates the scenario of an audio system with a Bluetooth connection. Generally, in such a system, an external device sends the audio stream to be played via Bluetooth. The audio system then returns acknowledgments to confirm the correct reception of the audio data. The Bluetooth signal is sent periodically because the audio stream has a constant rate.

This acknowledgment is equivalent to our BLE device in beacon mode but no external device will be sending data to the BLE device. Thus, the audio stream is generated in the BLE dongle to study the compromises of a single device. The setup of this experiment is shown in Fig. 9. The dongle generates a PWM at 1250 Hz (for ESP32) and 1000 Hz (for nRF52832) to an external class D audio Power Amplifier (PA), this last one is then connected to two 3 W speakers. The PWM output is connected to both the audio amplifier and a LED to provide an indicator of operation.

In this scenario several side-channels can occur, (i) the PWM signal can leak and directly impact the transceiver, (ii) the audio amplifier can create power supply disturbances that can impact the transceiver or (iii) the loudspeaker coils create an electromagnetic field that can disturb the internal signals.

The results of this test are given for the ESP32 and the nRF52832 in Fig. 10 that shows the spectrum difference at the output of the detector. First, one can observe that in both cases the PWM frequency is present in the spectrum, proving that there is a leak between the audio broadcasting and the BLE transmission. The two dongles have a different behavior: the amplitude of the red signals is 0.4 dB for the ESP32 and 2 dB for nRF52832.

During the tests on the nRF52832, it turned out that the audio stream was audible in the speakers although the wire between the

amplifier input and the PWM output was disconnected. In such scenario, the red signal is still present in the BLE signal with a peak of 2.7 dB. Since the speakers are still playing the signal, it means that the audio signal is present in the power supply of the board. The leak is not only due to the consumption of the amplifier but also to the BLE dongle itself. The amplitude of the spike being higher when the cable is disconnected, we can assume that the input of the audio amplifier acts as an attenuator on the side-channel. This behavior has been observed on two different nRF52832 boards but not on the ESP32 board. This difference may be due to the design of the two boards: the nRF52832 is a development board while the ESP32 is an industrial version, with a higher-grade power supply.

## 5.3. Pulse recovering

To find out the origin of the leak on the nRF52832 board, we first investigate to what extent a LED and the pulse signal that drives it can generate a compromise on the radio transceiver. To that goal, a PWM signal has been connected to a LED and it has been observed that a 4.2 dB spike can be observed with our interception system. The audio amplifier that was previously connected includes large capacitors in order to compensate noise generated in the power supply and thus probably reduces the amplitude of the side-channel.

Finally, the last experiment includes only a PWM signal that is sent to a General Purpose Input/Output (GPIO) output connected to nothing. In such case, the corresponding recovered signal is shown in Fig. 11. It shows that a leakage is still present at the same position as with the LED or the audio signal of the previous section, but its amplitude has been greatly reduced to 0.8 dB thus indicating that the LED was indeed leaking but is not the only one causing leaks.

The experiments of this section demonstrate that there is a combination of factors that can generate a leakage and that a small leak can be amplified internally. The PWM alone generates a leak but is amplified by the LED. Such a leak is a major security threat because it allows in an air-gap bridging context [3,28] to leak information on a radio transceiver without directly modifying its baseband signal but using a side-channel instead. It is therefore more difficult to detect that such attack is used as it is common for microcontroller to have unused outputs.

## 5.4. Research perspectives and envisioned countermeasures

In this paper, we have demonstrated that certain vulnerabilities can be exploited through Bluetooth transmissions, significantly increasing the attack surface of these devices. What was initially confined within a SoC is now transmitted via a signal with a much larger range through the telecom side-channel. We also highlighted the advantages
<figure><img src="image_14.png" /><figcaption>Fig. 10. Spectrum difference of FFT-BE output between with and without audio stream.</figcaption></figure>

<figure><img src="image_15.png" /><figcaption>Fig. 11. Spectrum difference of FFT-BE output between with and without PWM generated.</figcaption></figure>

of SDR approaches for signal acquisition, which offer greater flexibility compared to hardware probes.

These findings open several avenues for future research. First, the observed leaks are highly dependent on the specific boards used. A systematic analysis of other types of boards or other forms of red signals that could be emitted would help to gain a deeper understanding of potential vulnerabilities [29]. Second, regarding leakage models, this study focused on leaks stemming from AM coupling. However, other vulnerabilities, such as those caused by clock intermodulations, have also been identified [9,11]. Adapting the detection architecture to address these vulnerabilities would be an interesting direction for future works.

Finally, the development of these attack scenarios must be complemented by the design and evaluation of effective countermeasures. Such countermeasures can take two forms: first, ensuring that leaks are not emitted by improving the isolation between different parts of the SoC [30]; and second, preventing the reception of leakage signals, either by physically isolating the SoC carrying red signals [3] or by introducing a jamming signal specifically targeted at the spectral band of the leak [12,31].

Ultimately, a more nuanced understanding of the physical principles underlying these leaks is crucial for addressing them effectively [32]. Methods to identify when a target device is present are also needed [33].

## 6. Conclusions

This article focuses on telecom side-channels eavesdrops for IoT devices. While a legitimate telecommunication signal (black signal) is transmitted, it can be polluted by a compromising signal (red signal) that holds sensitive data. If these security breaches are difficult to detect, they can be passively eavesdropped at larger range than most of electromagnetic side channels. Frequency-hopping signals have been addressed as they are harder to track due to the frequently change of

their carrier frequency. After deriving the leakage and telecom models, a real-time interception system have been proposed leveraging SDR. We show that our architecture is capable to analyze the 200 MHz bandwidth of the X310 SDR in real time with a very low latency. Then, the potential vulnerabilities of low-cost Bluetooth System-on-Chips have been studied through real eavesdrops. We demonstrate that an audio output can be directly found in the Bluetooth signal for different commercial chips. We have finally demonstrated that a PWM pin can also lead to leak in the Bluetooth devices. It paves the way for dramatic air-gap bridging scenarios where sensitive data may be silently carried out from a chip using its unused outputs. This demonstrates the urgent need to revisit the menace index induced by telecom side-channels, especially for IoT deployment.

## Declaration of competing interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

## Acknowledgments

This work is funded by DGA, Brittany region and French National Research Agency (ANR) under the RedInBlack project (ANR-22-CE25-0007-01).

## Data availability

No data was used for the research described in the article.

## References

[1] C. Brent, A. Carlisle, A Survey and Taxonomy Aimed at the Detection and Measurement of Covert Channels, in: ACM Workshop on Information Hiding and Multimedia Security, IH&MMSec, 2016-06.

[2] J.M. McGinthy, A.J. Michaels, Semi-Coherent Transmission Security for Low Power IoT Devices, in: IEEE International Conference on Internet of Things (Things) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData), 2018, pp. 170–177.

[3] C. Lavaud, R. Gerzaguet, M. Gautier, O. Berder, E. Nogues, S. Molton, Whispering devices: A survey on how side-channels lead to compromised information, J. Hardw. Syst. Secur. 5 (2021) 143–168.

[4] I. Giechaskiel, K. Rasmussen, Taxonomy and challenges of out-of-band signal injection attacks and defenses, IEEE Commun. Surv. Tutor. (2019).

[5] G. Camurati, S. Poeplau, M. Muench, T. Hayes, A. Francillon, Screaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers, in: ACM Conference on Computer and Communications Security, CCS, 2018.

[6] M. Dardaillon, K. Marquet, T. Risset, A. Scherrer, Software defined radio architecture survey for cognitive testbeds, in: Proc. International Wireless Communications and Mobile Computing Conference, IWCMC, 2012, pp. 189–194.

[7] R. Fuji-Hara, Y. Miao, M. Mishima, Optimal frequency hopping sequences: A combinatorial approach, IEEE Trans. Inform. Theory 50 (10) (2004) 2408–2420.
[8] B. Hamilton, SINCGARS System Improvement Program (SIP) specific radio improvements, in: IEEE Tactical Communications Conference. Ensuring Joint Force Superiority in the Information Age, 1996.

[9] P. Ayoub, R. Cayre, A. Francillon, C. Maurice, BlueScream: Screaming channels on bluetooth low energy, in: Proc. 40th Annual Computer Security Applications Conference, ACSAC, 2024.

[10] N. Beaulieu, W. Hopkins, P. McLane, Interception of frequency-hopped spread-spectrum signals, IEEE J. Sel. Areas Commun. 8 (5) (1990) 853-870.

[11] J. Guillaume, M. Pelcat, A. Nafkha, R. Salvador, Attacking at non-harmonic frequencies in screaming-channel attacks, in: International Conference on Smart Card Research and Advanced Applications, Springer, 2023, pp. 87-106.

[12] E. Bout, V. Bout, A. Brighente, M. Conti, V. Loscri, Evaluation of channel hopping strategies against smart jamming attacks, in: Proc. IEEE International Conference on Communications, ICC, 2023, pp. 5210-5215.

[13] T. Wei, S. Wang, A. Zhou, X. Zhang, Acoustic Eavesdropping through Wireless Vibrometry, in: ACM International Conference on Mobile Computing and Networking, MobiCom, 2015.

[14] M. Zhao, T. Li, M.A. Alsheikh, Y. Tian, H. Zhao, A. Torralba, D. Katabi, Through-Wall Human Pose Estimation Using Radio Signals, in: IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR, 2018.

[15] B. Chen, V. Yenamandra, K. Srinivasan, Tracking Keystrokes Using Wireless Signals, in: ACM International Conference on Mobile Systems, Applications, and Services, MobiSys, 2015.

[16] G. Camurati, A. Francillon, F. Standaert, Understanding Screaming Channels: From a Detailed Analysis to Improved Attacks, Trans. Cryptogr. Hardw. Embed. Syst. (TCHES) (2020) 358-401.

[17] J. Choi, H.-Y. Yang, D.-H. Cho, TEMPEST comeback: A realistic audio eavesdropping threat on mixed-signal SoCs, in: ACM Conference on Computer and Communications Security, SIGSAC, 2020.

[18] O. Meynard, D. Réal, F. Flament, S. Guilley, N. Homma, J. Danger, Enhancement of simple electro-magnetic attacks by pre-characterization in frequency domain and demodulation techniques, in: ACM/IEEE Design, Automation Test in Europe, DATE, 2011.

[19] G. Goller, G. Sigl, Side Channel Attacks on Smartphones and Embedded Devices Using Standard Radio Equipment, in: International Workshop on Constructive Side-Channel Analysis and Secure Design, COSADE, 2015.

[20] J.-J. Quisquater, D. Samyde, ElectroMagnetic Analysis (EMA): Measures and Counter-Measures for Smart Cards, in: ACM International Conference on Research in Smart Cards: Smart Card Programming and Security, E-SMART, 2001.

[21] H. Urkowitz, Energy detection of unknown deterministic signals, Proc. IEEE 55 (4) (1967) 523-531.

[22] Y. Zeng, Y.C. Liang, R. Zhang, Blindly combined energy detection for spectrum sensing in cognitive radio, IEEE Signal Process. Lett. 15 (2008) 649-652.

[23] C. Lavaud, R. Gerzaguet, M. Gautier, O. Berder, E. Nogues, S. Molton, Toward Real time interception of Frequency Hopping Signals, in: IEEE International Workshop on Signal Processing Systems, SiPS, 2020.

[24] J. Tosi, F. Taffoni, M. Santacatterina, R. Sannino, D. Formica, Performance Evaluation of Bluetooth Low Energy: A Systematic Review, Sensors 17 (12) (2017).

[25] M. Braun, J. Pendlum, M. Ettus, RFNoC: RF network-on-chip, in: GNU Radio Conference, GRCon, 2016.

[26] J. Bezanson, J. Chen, B. Chung, S. Karpinski, V. Shah, J. Vitek, L. Zoubritzky, Julia: Dynamism and performance reconciled by design, Proc. ACM Program. Lang. 2 (2018) 1-23.

[27] C. Lavaud, R. Gerzaguet, M. Gautier, O. Berder, AbstractSDRs: Bring down the two-language barrier with Julia Language for efficient SDR prototyping, IEEE Embed. Syst. Lett. 13 (2021) 166-169.

[28] M. Guri, Y. Elovici, Bridgeware: The air-gap malware, Commun. ACM 61 (4) (2018) 74-82.

[29] M.M. Thu, M. Méndez Real, M. Pelcat, P. Besnier, You only get one-shot: Eavesdropping input images to neural network by spying soc-FPGA internal bus, in: Proc. International Conference on Availability, Reliability and Security, 2023, pp. 1-7.

[30] R. Sprabery, K. Evchenko, A. Raj, R.B. Bobba, S. Mohan, R. Campbell, Scheduling, isolation, and cache allocation: A side-channel defense, in: Proc. IEEE International Conference on Cloud Engineering, IC2E, 2018, pp. 34-40.

[31] J. Wang, X. Wang, Y. Jiang, A.K. Singh, L. Huang, M. Yang, Combating enhanced thermal covert channel in multi-/many-core systems with channel-aware jamming, IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst. 39 (11) (2020) 3276-3287.

[32] P. Ayoub, A. Hernandez, R. Cayre, A. Francillon, C. Maurice, PhaseSCA: When jitter meets electromagnetic side channels, IACR Trans. Cryptogr. Hardw. Embed. Syst. (2025).

[33] A. Chillet, R. Gerzaguet, K. Desnos, M. Gautier, E.S. Lohan, E. Nogues, M. Valkama, Understanding Radio Frequency Fingerprint Identification With RiFyFi Virtual Databases, IEEE Open J. Commun. Soc. (2024) 19, [Online]. Available: https://inria.hal.science/hal-04617950.

<figure><img src="image_16.png" /></figure>

**Corentin Lavaud** received the B.Sc. and M.Sc. in electronic engineering from the ENSSAT engineering school in 2018 and the Ph.D. degree in telecommunications at the University of Rennes, France in 2022. His research focuses on new kinds of TEMPEST attacks through sporadic signals. It includes complementary fields of signal processing, hardware architectures and software-defined radio.

<figure><img src="image_17.png" /></figure>

**Robin Gerzaguet** received the degree in electrical engineering from the Grenoble Institute of Technology, France, in 2011, and the Ph.D. degree from the Gipsa-Laboratory, University of Grenoble and ST-Microelectronics, in 2015. He then joined CEA-LETI, where he was involved in physical layer and filter bank multicarrier waveforms in the context of millimeter-wave transmissions. He is currently an Associate Professor with the IRISA Laboratory, University of Rennes, France. His research interests are in signal processing techniques and hardware architectures dedicated to digital communications and RF transceivers. They include multicarrier waveforms, digital RF impairments compensation and TEMPEST attacks.

<figure><img src="image_18.png" /></figure>

**Matthieu Gautier** holds the Engineering and M.Sc. degrees in electronics and signal processing engineering from the ENSEA graduate school and a Ph.D. degree from Grenoble-INP in 2006. From 2006 to 2011, he was a research engineer at Orange labs, INRIA and CEA-LETI laboratory. He joined University of Rennes in 2011 where he is currently a Full Professor at IUT Lannion and the IRISA Laboratory since 2024. His research activities are in the two complementary fields of embedded systems and digital communications for high-performance software-defined radio.

<figure><img src="image_19.png" /></figure>

**Olivier Berder** received the M.Sc. and Ph.D. degrees in electrical engineering from the University of Bretagne Occidentale, Brest, in 1999 and 2002, respectively. From 2002 to 2004 he was with the Laboratory for Electronics and Telecommunication Systems (LEST-UMR CNRS 6165), Brest. After a post-doc with the Speech and Sound Technologies and Processes Laboratory in Orange labs, Lannion, France, in March 2005 he joined University of Rennes where he is currently a Professor at IUT Lannion, and the laboratory IRISA in Rennes. He is the leader of GRANIT team and his research interests focus on cooperative techniques and power management for mobile communications and wireless sensor networks. He has co-authored more than 120 peer reviewed papers in international journals or conferences and has participated in numerous collaborative projects founded by either European Union or French National Research Agency.

<figure><img src="image_20.png" /></figure>

**Erwan Nogues** received his engineering and Ph.D. degrees respectively from University of Rennes and INSA Rennes in 2000 and 2016. He held several positions as a signal processing expert in the semiconductors industry. He is now a technical expert in the field of system security and is an associate researcher at the Electronics and Computer Engineering department of INSA Rennes. His main research interests include signal processing, embedded systems and cyber-security.

<figure><img src="image_21.png" /></figure>

**Stephane Molton** received the engineering degree from the University of Rennes in 1995. After holding several positions as a signal processing engineer in the semiconductor industry, he is now a technical expert in the software-defined radio area focusing on fast prototyping of signal processing algorithms onto the embedded architectures.