Interesting (proprietary?) adaptive HF modem spotted on 6670.0 and 7998.5 KHz/USB. The modem uses a waveform set from 188-110A and STANAG-4539 and switches from 300bps up to 4800bps modes with constant modulation rate of 2400 symbols/sec. The data transfer phase follows the 188-141A handshake between the ALE calls:
- CAMP,OUTPOST (in the sample recorded on 6670.0 Khz)
- HORBEN, CAMP (in the sample recorded on 7798.5 KHz)
(these callsigns are unknown to me, some DXers attribute these callsigns to the Swiss Emergency Network)
Although it is the same network,as can be supposed from the callsigns, it's interesting to note that in the sample recorded on 6670 KHz the 110A waveform exhibits four initial unmodulated tones at 500, 1200, 1700 and 2600 KHz which are non provided in the standard.
- CAMP,OUTPOST (in the sample recorded on 6670.0 Khz)
- HORBEN, CAMP (in the sample recorded on 7798.5 KHz)
(these callsigns are unknown to me, some DXers attribute these callsigns to the Swiss Emergency Network)
Although it is the same network,as can be supposed from the callsigns, it's interesting to note that in the sample recorded on 6670 KHz the 110A waveform exhibits four initial unmodulated tones at 500, 1200, 1700 and 2600 KHz which are non provided in the standard.
Me and J-4538 investigated the bitstreams after the removal of the overheads due to the bearer HF waveforms and we found a 128-bit period secondary protocol (Figure 1) no matter 188-110A or 4539!
 |
| Fig.1 - the 128-bit period of the secondary protocol |
It always starts with a longer sequence of ones followed by 64 bit header:
00011000 01000001 11000101 11100101 10111011 01001001 01111101 01011001
The number of ones vary and it is not a multiple of 8. So the sync can start anywhere within a byte.
The sync is followed by a 128 bit header where 40 bit (byte 9 to 13 of 16) are very similar in each transmission. This 128 bit sequence is sent 5 times. Example:
00001000 10100111 11010001 10111010 11000111 11011000 11111010 10011010 00000000 01000000 00000111 00001000 00001001 01001001 10001110 01011111
Now a 64 bit idle sequence follows (starting with 01). Finally the "data" is transmitted. Each transmission seems to have a lentgh of 6912 bit (starting with the 64bit sync and ending before an EOM)
 |
| Fig. 2 - 64 bit sync, 5*128bit + 64bit idle |
It looks like some typical encryption: 64 bit for the sync then a 128bit key which is repated 5 times and then some idle which is necessary that the ciphering device can load the key.
