PaperlayerView exact revision on arXiv

Source-linked AI summary

Semi-Cooperative Passive Integrated Sensing and Communication by Utilizing Physical Layer Information of 5G Signals

Bo Wei, Ryusei Ogane, Hang Song

arXiv:2609.09844v1eess.SYcs.SYeess.SP

TL;DR

Access to detailed cellular physical-layer information for semi-cooperative passive ISAC is limited. This paper develops an OAI- and SDR-based 5G system that extracts downlink physical-layer information and analyzes propagation. Experiments use different communication scenarios and show that multiple paths can be detected using two analysis approaches.

Abstract

from arXiv · show

In recent years, integrated sensing and communication (ISAC) has attracted significant attention towards future cellular networks. Currently, various works have demonstrated sensing performance in existing wireless communication systems. Most of the demonstrations are based on passive type due to the radio regulatory. However, because of the difficulty in access to the communication protocol stacks in commercial cellular systems, the evaluation of the cellular communication signals for semi-cooperative passive ISAC is limited. In this paper, a semi-cooperative passive ISAC system is developed with open-source 5G framework and software-defined radio devices. And the performance is experimentally evaluated by utilizing the physical layer information of actual 5G signals from the developed system. In this system, communication is established with 5G signals and physical layer information are obtained and extracted for analysis. The performance of the system is verified by conducting experiments under several communication scenarios including the synchronization, pinging, and data transmission. Different physical layer information is collected, and the propagation characteristics are analyzed by a multi-path configuration. The experiment results demonstrated that variable bandwidths were utilized for different communication scenarios and the multipath was successfully detected with two different approaches. These results show that the developed system is promising for semi-cooperative passive ISAC in wider application fields

II. RELATED WORK

Prior work distinguishes passive ISAC by how much the receiver knows about the transmitted signal. Semi-cooperative sensing has used WiFi channel information extensively, while access to detailed cellular physical-layer information remains limited.

II. RELATED WORK

  • Non-cooperative passive ISAC receives signals without demodulation or decoding, whereas semi-cooperative passive ISAC uses transmitted-signal information to extract details such as CSI.The distinction reflects whether protocol information is available to the receiver.Source: §II · p. 2
  • Non-cooperative demonstrations have used mmWave, WiFi, and digital terrestrial multimedia signals for movement, Doppler, or target detection.The cited examples include indoor human movement estimation with 25 GHz mmWave signals and Doppler extraction from WiFi using CAF.Source: §II · p. 2
  • WiFi semi-cooperative sensing uses fine-grid subcarrier CSI to study human activity, vital signals, intrusion, localization, and propagation-environment changes.Examples include gait identification, vital-signal monitoring, activity recognition, humidity estimation, and tunnel safety monitoring.Source: §II · pp. 2–3
  • Cellular semi-cooperative sensing is constrained by limited access to detailed channel information; user-accessible information is generally coarse-grid RSSI updated on a seconds-scale.The paper notes that this slow-rate coarse information is unsuitable for accurate sensing in dynamic scenarios.Source: §II · p. 3

III. 5G SEMI-COOPERATIVE PASSIVE ISAC

The paper uses existing 5G reference signals to estimate propagation channels for sensing. Its focus is downlink DM-RS, whose fixed PBCH and dynamically allocated PDSCH forms provide different signal structures and bandwidths.

A. Reference Signals in 5G

  • 5G channel estimation from demodulated physical-layer signals can provide channel status for sensing, and the paper focuses on downlink DM-RS without requiring extra spectrum.DM-RS occurs in PDSCH for data transmission and in PBCH associated with the SSB.Source: A. Reference Signals in 5G · p. 3, §III · p. 3
  • During synchronization, the UE extracts the cell ID to derive DM-RS positions in the SSB, then estimates the channel and demodulates PBCH.The SSB has 20 resource blocks, 240 subcarrier frequencies, and four OFDM symbols; PSS is in symbol 0, PBCH in symbols 1 and 3, and SSS shares symbol 2 with PBCH.Source: A. Reference Signals in 5G · p. 3
  • PDSCH embeds DM-RS with data blocks, and its allocation depends on parameters including mapping type and configuration type.Channel estimates from PDSCH DM-RS can be used to recover the conveyed data.Source: A. Reference Signals in 5G · p. 3
  • PBCH DM-RS is fixed in time and frequency, while PDSCH DM-RS changes with service conditions and varies in size and bandwidth.The paper investigates both forms for comparison because frequency-domain size affects sensing ability.Source: A. Reference Signals in 5G · p. 3

B. Channel Estimation by DM-RS

The system estimates channel state from known downlink DM-RS and analyzes it for sensing. The authors implement this processing on a UE using an open-source 5G system and evaluate it across communication scenarios and configured multipath paths.

B. Channel Estimation by DM-RS

  • Comparing transmitted DM-RS with the received signal yields per-subcarrier channel state that supports both data demodulation and sensing of multipath or movement-related changes.The known DM-RS pattern provides the transmitted reference, and the received signal is transformed into the frequency domain.Source: B. Channel Estimation by DM-RS · p. 3

C. Semi-Cooperative ISAC system

  • The OAI-based test system uses one gNB and one UE, with downlink sensing performed at the UE.Two SDRs serve as radio transceivers; the gNB and core network run on one computer, while the UE runs on another.Source: C. Semi-Cooperative ISAC system · p. 3, Figure 1 · p. 4
  • A cable-based multipath setup splits the gNB signal into a 0.6 m path and longer paths of several tens of meters, with attenuation used to adjust received-power balance.The uplink is directly connected by one cable, while the downlink path is split using a power divider and combiner.Source: C. Semi-Cooperative ISAC system · pp. 3–4
  • Experiments cover synchronization, pinging, and high-rate data transmission, with UE-side DM-RS extraction and analysis of multipath effects.The system operation is illustrated in Fig. 2.Source: C. Semi-Cooperative ISAC system · p. 4, Figure 2 · p. 4

IV. SIGNAL ANALYSIS METHODS

The section presents two UE-side methods for analyzing received signals in a multipath configuration.

IV. SIGNAL ANALYSIS METHODS

  • The UE uses two approaches to analyze received signals in multipath configurations.One operates in the time domain and the other in the frequency domain.Source: §IV · p. 4
  • The power delay profile analyzes multipath in the time domain.It is one of the two methods used on the UE side.Source: §IV · p. 4
  • Frequency-domain analysis examines the superposition of waves.It is the second method used alongside the time-domain power delay profile.Source: §IV · p. 4

A. Power Delay Profile

The power delay profile (PDP) is derived from the estimated frequency response and used to inspect multipath arrival delays. Its time resolution depends on bandwidth, while windowing trades reduced sidelobes for degraded resolution.

A. Power Delay Profile

  • PDP is computed from the UE-estimated channel response by transforming it into an impulse response and taking its squared magnitude.Peaks in the PDP indicate arrival times of multiple paths.Source: A. Power Delay Profile · p. 4
  • Time resolution is the reciprocal of bandwidth, which is calculated as the number of subcarriers times their spacing.Bandwidth and resulting time resolution vary across communication scenarios.Source: A. Power Delay Profile · p. 4
  • A window function can be applied to the channel response before the inverse Fourier transform to suppress sinc sidelobes, but it can degrade time resolution.Source: A. Power Delay Profile · p. 4
  • Examining PDP peaks provides the arrival times of multiple propagation paths.Source: A. Power Delay Profile · p. 4

B. Superposition of Waves

For a two-path channel, the paths’ differing delays produce frequency-dependent interference. The periodic fluctuations in the channel response can be used to derive the delay difference.

B. Superposition of Waves

  • Two paths with different delays interfere at each subcarrier, producing periodic fluctuations in the frequency-domain channel response.The second path’s phase rotates across subcarriers with their frequency spacing.Source: B. Superposition of Waves · p. 4
  • The period of fluctuations in the channel response can be examined to derive the time difference between two paths.Source: B. Superposition of Waves · p. 4

V. EXPERIMENTAL RESULTS

Experiments used a USRP B210 SDR with a 30 kHz subcarrier spacing. The sampling rate and effective subcarrier count were set to support stable communication within the SDR and USB data-transfer constraints.

V. EXPERIMENTAL RESULTS

  • The USRP B210 supports up to 56 MHz bandwidth and was operated with a 30 kHz subcarrier spacing.Source: §V · p. 4
  • The maximum resource-block count was set to 106, a value defined by the 5G standard, while the USB 3.0 link’s theoretical data rate was 5.0 Gbps.Source: §V · pp. 4–5
  • To stabilize transmission, the sampling rate was reduced to 46.08 MS/s, covering 1,536 subcarrier frequencies and retaining all 1,272 effective subcarriers.The resulting bandwidth is 38.16 MHz; the source states that downsampling does not affect communication.Source: §V · p. 5

A. Bandwidth and PDP

The experiments extracted channel responses in synchronization, ping, and high-rate data scenarios. The usable bandwidth increased across these scenarios, with finer PDP resolution at wider bandwidths.

A. Bandwidth and PDP

  • 240 effective subcarriers provided 7.2 MHz bandwidth during synchronization, producing a relatively broad PDP main lobe.The channel response was extracted from PBCH DMRS in the SSB; the PDP used an 8,192-point zero-padded transform.Source: A. Bandwidth and PDP · p. 5
  • 576 effective subcarriers provided 17.28 MHz bandwidth during ping, yielding a narrower PDP main lobe than the PBCH case.The PDP used an 8,192-point zero-padded transform.Source: A. Bandwidth and PDP · p. 5
  • 1,272 effective subcarriers across the maximum 106 RB gave high-rate data transmission the best time resolution among the tested scenarios.The channel response was extracted from PDSCH DMRS during downlink iPerf3 transmission.Source: A. Bandwidth and PDP · p. 5

B. PDP in two-path configuration

In two-path tests, the PDSCH DMRS channel response revealed separable PDP peaks whose measured delays agreed with cable-based theoretical delays. Detection became less clear as path spacing narrowed and the paths were unbalanced.

B. PDP in two-path configuration

  • In the two-path configuration, high-rate iPerf3 transmission was tested over 0.6 m and 30 m cable paths; a 20 dB attenuator balanced the paths, and each 10 m cable had about 7 dB insertion loss.Source: B. PDP in two-path configuration · p. 5
  • 0.114 μs (PDP) and 0.118 μs (channel response) matched the 0.118 μs theoretical delay for the 0.6 m/30 m paths.The response repeated about every 283 subcarriers (8.49 MHz); the balanced paths also produced low-amplitude frequencies through destructive addition.Source: Figure 5 · p. 6, B. PDP in two-path configuration · p. 6
  • 0.073 μs (PDP) and 0.076 μs (channel response) both agreed with the 0.078 μs theoretical delay for the 0.6 m/20 m paths.The channel-response repetition was about 438 subcarriers (13.14 MHz).Source: Figure 6 · p. 6, B. PDP in two-path configuration · p. 6
  • 0.037 μs (PDP) matched the 0.038 μs theoretical delay for the 0.6 m/10 m paths, but the first peak was weak and response repetition was difficult to recognize.The unbalanced setup made the first peak liable to be missed without prior path-difference information.Source: Figure 7 · p. 6, B. PDP in two-path configuration · p. 6

C. PDP in multi-path configuration

With three cable paths, the PDP showed three peaks, demonstrating that several paths could be detected from 5G physical-layer information. The reported delay differences were close to theoretical values, with PDP time resolution identified as a source of error.

C. PDP in multi-path configuration

  • Three PDP peaks were observed for the 0.6 m, 10 m, and 20 m paths; adjacent delays were 0.037 μs and 0.045 μs versus theoretical 0.037 μs and 0.040 μs.The second spacing's discrepancy was attributed to the approximately 4.1 ns PDP time resolution; the experiment demonstrated detection of several peaks.Source: C. PDP in multi-path configuration · p. 6, Figure 8 · p. 7

VI. CONCLUSION

The paper concludes that accessing downlink DMRS in a modified OAI framework enables passive sensing from 5G physical-layer information. Experiments detected multiple paths, including a 10 m path difference at 38.16 MHz bandwidth.

VI. CONCLUSION

  • At 38.16 MHz bandwidth, the system experimentally detected a 10 m path difference during high-rate data transmission.The conclusion reports variable utilized bandwidth across communication scenarios and multiple-path differentiation during high-rate transmission.Source: §VI · p. 7
  • The system extracts and analyzes downlink DMRS channel responses and calculates PDP without introducing extra frames or signals.The paper describes the system as passive and compliant with communication protocols.Source: §VI · p. 7
  • The authors conclude that sensing can occur without interrupting communication and can be deployed with existing communication systems.They describe the system as promising for wider field applications.Source: §VI · p. 7
Loading 2609.09844v1…