{"id":{"repo_id":"cambridge","oai_identifier":"oai:www.repository.cam.ac.uk:1810/290902"},"canonical_url":"https://search.dev.ndltd.org/etd/cambridge/oai:www.repository.cam.ac.uk:1810/290902","repository":{"repo_id":"cambridge","name":"Cambridge University","base_url":"https://api.repository.cam.ac.uk/server/oai/request"},"display":{"title":"Exploiting quasiperiodic electromagnetic radiation using software-defined radio","abstract":"Electronic devices emanate unintentional electromagnetic radiation from which an attacker can extract sensitive information. In video display units these are quasiperiodic: nearly periodic in the short term. Video-eavesdropping attacks on these, a main motivation for the use of TEMPEST shielded equipment in security-critical applications, have evolved little since first publicly demonstrated by van Eck in 1985. I investigate digital signal processing techniques that exploit the quasiperiodic nature of digital video signals, with TMDS-encoded data on HDMI/DVI cables as the main example. After first discussing the practicalities of intercepting compromising emanations from the UHF frequency band, using a software-defined radio platform to perform IQ down conversion, I outline the process to carry out a video eavesdropping attack, and methods for rasterising intercepted data. Using a database of video modes, such as VESA and CEA standards, I identify viable eavesdropping targets by fitting likely harmonics of emanating clock signals to a model. Video signals contain blanking intervals that create characteristic periodicities; cepstral features can be used to eliminate false positives, and provide improved performance over autocorrelation as a method of recovering synchronisation frequencies. The signal-to-noise ratio of intercepted emanations is often very poor. Coherent periodic averaging in the complex domain can suppress noise and uncorrelated background sources. I design a phase-locked loop to perform clock recovery and synchronisation of the video signal, negating the effects of temperature drift in the local oscillators. This permits averaging arbitrary-length recordings, increasing the range at which an attack can be performed. I discuss the implications this may have on existing protection standards. Finally, I present a method to recover bandwidths higher than that which the SDR frontend hardware is nominally capable of. I use the cross-correlation between multiple overlapping lower-bandwidth recordings to correct time and phase offsets, and a zero-phase Linkwitz-Riley filter pair to combine them. The resulting higher-bandwidth recordings improve raster clarity, and enable use of a hidden Markov model to recover colour information.","abstract_html":"Electronic devices emanate unintentional electromagnetic radiation from which an attacker can extract sensitive information. In video display units these are quasiperiodic: nearly periodic in the short term. Video-eavesdropping attacks on these, a main motivation for the use of TEMPEST shielded equipment in security-critical applications, have evolved little since first publicly demonstrated by van Eck in 1985. I investigate digital signal processing techniques that exploit the quasiperiodic nature of digital video signals, with TMDS-encoded data on HDMI/DVI cables as the main example. After first discussing the practicalities of intercepting compromising emanations from the UHF frequency band, using a software-defined radio platform to perform IQ down conversion, I outline the process to carry out a video eavesdropping attack, and methods for rasterising intercepted data. Using a database of video modes, such as VESA and CEA standards, I identify viable eavesdropping targets by fitting likely harmonics of emanating clock signals to a model. Video signals contain blanking intervals that create characteristic periodicities; cepstral features can be used to eliminate false positives, and provide improved performance over autocorrelation as a method of recovering synchronisation frequencies. The signal-to-noise ratio of intercepted emanations is often very poor. Coherent periodic averaging in the complex domain can suppress noise and uncorrelated background sources. I design a phase-locked loop to perform clock recovery and synchronisation of the video signal, negating the effects of temperature drift in the local oscillators. This permits averaging arbitrary-length recordings, increasing the range at which an attack can be performed. I discuss the implications this may have on existing protection standards. Finally, I present a method to recover bandwidths higher than that which the SDR frontend hardware is nominally capable of. I use the cross-correlation between multiple overlapping lower-bandwidth recordings to correct time and phase offsets, and a zero-phase Linkwitz-Riley filter pair to combine them. The resulting higher-bandwidth recordings improve raster clarity, and enable use of a hidden Markov model to recover colour information.","abstract_has_math":false,"creators":["O'Connell, Christian David"],"institution":"University of Cambridge","degree_name":"Doctor of Philosophy (PhD)","degree_level":"Doctoral","degree_discipline":null,"degree_department":null,"school":null,"contributors":[],"advisors":["Kuhn, Markus"],"committee_chairs":[],"committee_members":[],"year":2019,"date_issued":"2019-04-27","date_published":"2019-04-27","updated_at":"2026-07-22T22:24:32Z","subjects":["Digital Signal Processing","TEMPEST","Side-channel attack"],"languages":["en"],"rights":[],"rights_urls":["https://apollo8-f-pro.lib.cam.ac.uk/bitstreams/db6e2818-c979-418d-99a4-2db3b8d6f29d/download","https://www.rioxx.net/licenses/all-rights-reserved/"],"identifier_entries":[]},"links":{"outbound_url":"https://doi.org/10.17863/CAM.38085","outbound_label":"DOI","outbound_source":"dc:identifier.doi"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor.advisor","label":"Advisor","values":["Kuhn, Markus"]},{"key":"dc:creator","label":"Author","values":["O'Connell, Christian David"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date.issued","label":"Date","values":["2019-04-27"]},{"key":"dc:publisher.institution","label":"Dc Publisher Institution","values":["University of Cambridge"]},{"key":"dc:relation.isreferencedby.uri","label":"Dc Relation Isreferencedby URI","values":["https://www.repository.cam.ac.uk/handle/1810/290902"]},{"key":"dc:type","label":"Dc Type","values":["Thesis"]},{"key":"dc:type.qualificationlevel","label":"Dc Type Qualificationlevel","values":["Doctoral"]},{"key":"dc:type.qualificationname","label":"Dc Type Qualificationname","values":["Doctor of Philosophy (PhD)"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["Digital Signal Processing","TEMPEST","Side-channel attack"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language","label":"Dc Language","values":["en"]},{"key":"dc:rights","label":"Dc Rights","values":["https://apollo8-f-pro.lib.cam.ac.uk/bitstreams/db6e2818-c979-418d-99a4-2db3b8d6f29d/download","https://www.rioxx.net/licenses/all-rights-reserved/"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier.doi","label":"DOI","values":["10.17863/CAM.38085"]},{"key":"dc:identifier.uri","label":"Identifier URI","values":["https://apollo8-f-pro.lib.cam.ac.uk/bitstreams/43faff7a-6bb9-4d01-b8a1-1c6b4e14a4e7/download"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description.abstract","label":"Abstract","values":["Electronic devices emanate unintentional electromagnetic radiation from which an attacker can extract sensitive information. In video display units these are quasiperiodic: nearly periodic in the short term. Video-eavesdropping attacks on these, a main motivation for the use of TEMPEST shielded equipment in security-critical applications, have evolved little since first publicly demonstrated by van Eck in 1985. I investigate digital signal processing techniques that exploit the quasiperiodic nature of digital video signals, with TMDS-encoded data on HDMI/DVI cables as the main example. After first discussing the practicalities of intercepting compromising emanations from the UHF frequency band, using a software-defined radio platform to perform IQ down conversion, I outline the process to carry out a video eavesdropping attack, and methods for rasterising intercepted data. Using a database of video modes, such as VESA and CEA standards, I identify viable eavesdropping targets by fitting likely harmonics of emanating clock signals to a model. Video signals contain blanking intervals that create characteristic periodicities; cepstral features can be used to eliminate false positives, and provide improved performance over autocorrelation as a method of recovering synchronisation frequencies. The signal-to-noise ratio of intercepted emanations is often very poor. Coherent periodic averaging in the complex domain can suppress noise and uncorrelated background sources. I design a phase-locked loop to perform clock recovery and synchronisation of the video signal, negating the effects of temperature drift in the local oscillators. This permits averaging arbitrary-length recordings, increasing the range at which an attack can be performed. I discuss the implications this may have on existing protection standards. Finally, I present a method to recover bandwidths higher than that which the SDR frontend hardware is nominally capable of. I use the cross-correlation between multiple overlapping lower-bandwidth recordings to correct time and phase offsets, and a zero-phase Linkwitz-Riley filter pair to combine them. The resulting higher-bandwidth recordings improve raster clarity, and enable use of a hidden Markov model to recover colour information."]},{"key":"dc:format.checksum.md5","label":"Dc Format Checksum Md5","values":["d7b76d5de9d97be9b70f1cbdd0de39b1","87eda9de84448d1f82354d60eee3eb5f"]},{"key":"dc:title","label":"Title","values":["Exploiting quasiperiodic electromagnetic radiation using software-defined radio"]}]}],"canonical_facts":{"dc:contributor.advisor":["Kuhn, Markus"],"dc:creator":["O'Connell, Christian David"],"dc:date.issued":["2019-04-27"],"dc:description.abstract":["Electronic devices emanate unintentional electromagnetic radiation from which an attacker can extract sensitive information. In video display units these are quasiperiodic: nearly periodic in the short term. Video-eavesdropping attacks on these, a main motivation for the use of TEMPEST shielded equipment in security-critical applications, have evolved little since first publicly demonstrated by van Eck in 1985. I investigate digital signal processing techniques that exploit the quasiperiodic nature of digital video signals, with TMDS-encoded data on HDMI/DVI cables as the main example. After first discussing the practicalities of intercepting compromising emanations from the UHF frequency band, using a software-defined radio platform to perform IQ down conversion, I outline the process to carry out a video eavesdropping attack, and methods for rasterising intercepted data. Using a database of video modes, such as VESA and CEA standards, I identify viable eavesdropping targets by fitting likely harmonics of emanating clock signals to a model. Video signals contain blanking intervals that create characteristic periodicities; cepstral features can be used to eliminate false positives, and provide improved performance over autocorrelation as a method of recovering synchronisation frequencies. The signal-to-noise ratio of intercepted emanations is often very poor. Coherent periodic averaging in the complex domain can suppress noise and uncorrelated background sources. I design a phase-locked loop to perform clock recovery and synchronisation of the video signal, negating the effects of temperature drift in the local oscillators. This permits averaging arbitrary-length recordings, increasing the range at which an attack can be performed. I discuss the implications this may have on existing protection standards. Finally, I present a method to recover bandwidths higher than that which the SDR frontend hardware is nominally capable of. I use the cross-correlation between multiple overlapping lower-bandwidth recordings to correct time and phase offsets, and a zero-phase Linkwitz-Riley filter pair to combine them. The resulting higher-bandwidth recordings improve raster clarity, and enable use of a hidden Markov model to recover colour information."],"dc:format.checksum.md5":["d7b76d5de9d97be9b70f1cbdd0de39b1","87eda9de84448d1f82354d60eee3eb5f"],"dc:identifier.doi":["10.17863/CAM.38085"],"dc:identifier.uri":["https://apollo8-f-pro.lib.cam.ac.uk/bitstreams/43faff7a-6bb9-4d01-b8a1-1c6b4e14a4e7/download"],"dc:language":["en"],"dc:publisher.institution":["University of Cambridge"],"dc:relation.isreferencedby.uri":["https://www.repository.cam.ac.uk/handle/1810/290902"],"dc:rights":["https://apollo8-f-pro.lib.cam.ac.uk/bitstreams/db6e2818-c979-418d-99a4-2db3b8d6f29d/download","https://www.rioxx.net/licenses/all-rights-reserved/"],"dc:subject":["Digital Signal Processing","TEMPEST","Side-channel attack"],"dc:title":["Exploiting quasiperiodic electromagnetic radiation using software-defined radio"],"dc:type":["Thesis"],"dc:type.qualificationlevel":["Doctoral"],"dc:type.qualificationname":["Doctor of Philosophy (PhD)"]},"updated_at":"2026-07-22T22:24:32Z"}