a curious AT-3400D/AT-3104 (CIS-12) modem configuration

Interesting catch of an AT-3400D modem (also known as CIS-12 or MS-5) running on 14344.0 KHz/USB with the quite uncommon 9 channel configuration (3-out-of-12) as shown in Figure 1 below

Fig. 1

CIS-12, as you know, is a pseudo OFDM 12-tone (+ 1 pilot) waveform using PSK2 or PSK4 modulation at speed of 120 Baud while the modem name is AT-3004D (or its newer counterpart AT-3104). Channels 1-10 are used for data, 11 and 12 are test/service channels, therefore the "aggregate" speed is 1200 Baud. 

Fig. 2

https://disk.yandex.com/d/HWWIfdAR6aLKuA

CIS Makhovik (T-230) in CIS-12 and PSK2/1200bps waveforms

Recently my friend KarapuZ gave me the chance to analyze a CIS-12 bitstream and I took the opportunity to wotk on the "format" of Makhovik and then compare the CIS-12 stream with other Makhovik  streams coming from PSK2/1200bps modulations. The results are rather interesting even if the lack of official documentation and the number of available samples do not allow any exact classification but only hypotheses.

Makhovik (the "flywheel") is a well known Soviet-Mil crypto system also used by The National People's Army of the former German Democratic Republic (NVA, Nationale Volksarmee). Although someone classifies Makhovik as vocoder, it can can be used for time-multiplexed encryption of both voice and data up to 9600 bps. It's official name is "T-230 bundle ciphering device for teleprinter and data connections" and was designed to operate in UHF but very often is found in LF and in HF.

T-230 main unit (Fig. 1) consists of four slots:
AT-3002M multi-channel modem for LF channels,
AT-3004D multi-channel modem for HF channels (CIS-12 waveform, also known as MS5 or "Fire"),
AT-3001M voice scrambler (five per unit system maximum),
AT-3025 signaling unit and pager (two per device system).

The T-230-1A is a single-channel version of the T-230. The device contains the cipher, modem and radio as well the vocoder. The system is constructed with 3 modules / blocks and provides  two 1200bps channels in its basic configuration. Several T-230-1A can be used in stationary operation with the modem of the multi-channel variant, AT-3002 and AT-3004D. 8 keys can be set for a maximum of 8 subscriber networks.

Fig.1 - a T-230 system

AT-3004D/AT-3104 (CIS-12)
CIS-12 is a pseudo OFDM 12-tone (+ 1 pilot) waveform using PSK2 or PSK4 modulation at speed of 120 Baud while the modem name is AT-3004D (or its newer counterpart AT-3104). Channels 1-10 are used for data, 11 and 12 are test/service channels, therefore the "aggregate" speed is 1200 Baud (just as the baudrate of the waveform of T-230-1A system).
The structure of the preamble (Fig. 2) in some way resembles the one described in MIL 188-220 Appendix D, "standards for COMSEC transmissions": I refer to that terminology just for the sake of clarity and to better illustrate my guess, as said there is no confirm about it. 

Fig.2 - CIS-12 Makhovik

The two "frame sync" blocks consist of a 15/30-bit repeating pattern. The block bewteen the two frame sync blocks is the more interesting (Fig. 3). It consists of 511 bits long pseudo-random sequences generated by the primitive polynomial x^9+x^5+1 [1], thus meeting with ITU Recommendation O.153 [2]. This pattern is primarily intended for error measurements at bitrates up to 14.4 kbit/s. Anyway, 511-bit length sequences are also used for synchronization purposes as in 188-110B "39-tone parallel mode" (see Appendix B #5.4.3). Since the 511-bit block is not reinserted, I tend to think that it's used to sync the receive side (the modem or the crypto device). It's worth noting that although ITU O.153 reports that the longest sequence of ZEROs is 8 (non-inverted signal), I found some sequences with a greater length: maybe it can depend on the OFDM demodulator or the quality of the signal, or maybe the used sequences are not fully ITU O.153 compliant.

Fig.3 - CIS-12 511-bit sequences

Finally, what I call here as the "Message Indicator" is a 720-bit long block consisting of 8-time triplicate 30-bit sequences. This part is composed of eight strings of 30 bits and each string is repeated 3 times (Fig. 4). The x3 redundancy, as well as in other krypto device as KG-84, is used to improve the accuracy and realiability of the reception. Encrypted data follow this block.

Fig.4 - CIS-12 720-bit MI

T-230-1A (PSK2 1200bps)
The same blocks (sync,511,MI), with a different arrangement, can be observed in a full sample of a PSK2 1200bps (file "_b" in the downloadable zip archive). In this case the 30-bit sync pattern is reinserted several times as well as the MI blocks (Fig. 5).

Fig.5 - T-230-1A Makhovik

In my archive I found other samples that presumably are attributable to T-230-1A (files "_a" and "_c" in the downloadable zip archive): unfortunately I went late on these transmissions therefore it was not possible to examine their preamble.
In these samples (Fig. 6) the 30-bit sync frame block is missing but, as I specified, it could be inserted at the start of the transmission. A second interesting feature is the use of sequences of 511 bits of length but which are not originated by the polynomial x^9+x^5+1! (fixed in this post)
 

Fig.6 - other PSK2 1200bps samples with Makhovik format

All the three PSK2 samples anyway have the same 30-bit MI structure as the one seen in CIS-12 (Fig. 7)

Fig.7 - 30-bit MI blocks

I would like to point out that this post does not claim to provide a description of the Makhovik encryption protocol but is just limited to the presentation of results obtained from the analysis of some samples: further (many) recordings are needed as well as tips and help from friends.

https://yadi.sk/d/j9HShkWFQo5z9g

[1] https://en.wikipedia.org/wiki/Linear-feedback_shift_register
[2] https://www.itu.int/rec/T-REC-O.153/en

CIS-12 & CIS Selcall FSK 150Bd/200 ("Vishnya")

Interesting and quite rare CIS-12 & CIS Selcall FSK 150Bd/200 - aka "Vishnya" - picked up by my friend AngazU using northern Europe KiwiSDRs in the 5 MHz band. Also thanks to friends cryptomaster and KarapuZ for pointing  out the name of the FSK signal and some interesting links: actually I met only single CIS "Vishnya" selcalls some months ago (November 2017) but I forgot it
http://i56578-swl.blogspot.com/2017/11/cis-selcall-vishnya-fsk-150bd200.html

CIS selcall is mentioned here in radioscanner:
http://signals.radioscanner.ru/base/signal106/
http://signals.radioscanner.ru/base/signal251/

It's notice that:
a) before the moment of transfer of CIS-12 signal, the equipment correctly stops transmission and also correctly restarts it after transferring the selcall;
b) since CIS-12 has a pilot tone at 3300Hz, the FSK insertions are centered on the suppressed carrier (zero offset from the nominal frequency);
c) after demodulation, CIS selcall exhibits a 45-bit period.

Fig. 1

Fig. 2

Fig. 3

UTE listeners frequently refer to a waveform using the name of the source equipment: in this case the nickname "Vishnya" comes from R-016V "Вишня" equipment, or R-016V "Vishnya" using the latin alphabet, which stands for the English "Cherry"  (Fig. 4).

Fig. 4 - R-016V "Вишня"

http://www.russianarms.ru/forum/index.php?topic=10775.0

http://window.edu.ru/catalog/pdf2txt/042/48042/23756?p_page=8
 

CIS-12 TDoA measurements using GPS time-stamped IQ samples from KiwiSDRs

TDOA (Time Difference Of Arrival), also known as multilateration, is a well-established technique for the geolocation of RF emitters. Using three or more receivers, TDOA algorithms locate a signal source from the different arrival times at the receivers.
In this case, TDoA measurements are related to a CIS-12 signal (modem AT-3004D) spotted this morning on 11414.0 KHz/usb and use GPS time-stamped IQ samples from four KiwiSDRs: F1JEK (JN05hs, southwestern France), SV3EXP (KM07qx, west Greece), UR5VIB (KN68DL, central Ukriane) and KHIMKI (KO85qw, near Moscow city Russia). 

Cross correlations suggest the Crimean peninsula as the area of Tx antenna. Since CIS-12 is widely used by Rus-Ny, it's quite reasonable to assume that the Tx be in Sevastopol, Black Sea fleet HQ. Note the scattering in the correlations involving the French SDR (F1JEK) which are due to multipath propagation.

 

Plots are obtained using my (old) Ubuntu 12.06 LTS updated to gcc 6.6 and gnuplot 4.4; TDoA algorithms implemented by Christoph mayer:

https://github.com/hcab14/TDoA 

and GNU Octave, scientific programming language, version 4.4:

https://www.gnu.org/software/octave/ 

AT-3004D (CIS-12): MPSK 12-tones PSK-2, PSK-4 120 Baud

CIS-12 is a Soviet military pseudo OFDM 12-tones + 1 pilot tone waveform allowing scrambled voice or data-communication at 120 Baud rate, modulation PSK-2 or PSK-4. CIS-12 is also known as MS-5 (sometimes also as FIRE) while the modem name is AT-3004D (or its newer counterpart  AT-3104).  

http://signals.radioscanner.ru/base/signal37/

"An interesting feature of these signals is that the sub-carriers are not orthogonal, since the manipulation speed is 120 Hz and channel spacing is 200: it means that each channel is formed separately, not as in OFDM using IFFT all at once, although the OFDM technology is used. CIS-12 modems may appear in three different variants, according to the n-ary PSK modulation: 2-PSK, 4-PSK offset (doesn't turn on 180^) and 4-PSK.Channels 1-10 are for user-data while 11 and 12 for the inspection. Accordingly, the aggregate information rate is 1200 and 2400 (PSK-2 and PSK-4)."

PSK-2 waveform:

 

PSK-4  waveform:
KarapuZ sent me a sample of this mode along with his comment:

"this mode modem is less resistant to interference, it is mainly used to transmit a surface wave, or at a distance of not more than one hop. A chance to hear him in Italy is very small".

 

CIS-12: an example of link-setup

heard (or better.. "seen") on 14 March at 10556.0 USB (10558.0 cf) 0740z. I posted the log and a short recording within a short analysis to UDXF list and below the interesting comments  by Trond Jacobsen - Hvaler archipelago, SE Norway (59.0333N 11.0333E JO59MA).

"The initial part of the opchat could have been very short. Most likely they migrated from another frequency and already had agreed on using CIS-12 (QYT4), - and just sendt a "qrv?" and got "qrv" in return. This was then followed up by a "qnj" (can you copy me), the op replies and they set up the crypto link.
Note that some Russian units key the second (in this case the third) tone of the CIS-12 in Morse to send opchat, in preference to using a separate Morse net like the navy does.

 1) the op told the other end of the link that "I copy you well" (QNJ3):

 

 2) and that they are ready to use "special equipment" (QJB3):

Interesting that they used "qnj" instead of "qrj" (QNJ has a wider range of response (1-5) then QNJ (1-3)) and that they used the additional QJB3 prior to the use of the CIS-12 as CIS-12 in itself is "special equipment" and is arranged used with the qyt4.
Drill or excersise maybe ??"

Thanks to Trond for the his interesting commets.