SSB-Based Signal Processing for Passive Radar Using a 5G Network

This article presents an alternative processing chain for the passive radar using fifth-generation (5G) standard technology for broadband cellular networks as illuminators of opportunity. The proposition is to use a 5G synchronization signal block's (SSB) periodically transmitted modulated pulse in 5G-based passive coherent location (PCL) system processing. Although the SSB periodicity limits the velocity ambiguity, the article describes a solution to tackle this problem in a single target scenario. The method is advantageous when there is a lack of transmission in the telecommunication channel, and the 5G SSB is the only existing signal. The article proposes a signal processing pipeline for a 5G-based PCL that is inspired by passive radars using noncooperative pulse radar as an illumination source. The method has been validated using simulated and real-life 5G data measurements. The results presented in the article show the possibility of detecting a moving target with a lack of data transmission in the 5G network, using only the SSB when the classical passive radar signal processing fails. The presented results prove the possibility for a significant increase of 5G network-based PCL utilization in short-range applications.

contrast to, e.g., the digital video broadcast-terrestrial (DVB-T) signal, the 5G transmission is content-dependent; thus, the classical passive coherent location (PCL) processing based on a cross-ambiguity function (CAF) cannot always be applied.When no user is downloading a vast amount of data in a given communication cell, the base station transmits periodically only synchronization signal bursts, i.e., SSBs [8].
The lack of content in the transmitted signal makes the 5Gbased passive radar blind.This impediment regarding 5G signals has not been discussed in the literature so far.Typically, the authors have considered a continuous transmission or synthetically generated waveform, e.g., using software-defined radio (SDR) [9], [10], [11], [12], [13], [14], or forced high network traffic by several terminals downloading massive files [15].In a practical scenario, high traffic cannot always be assumed.For example, near the borders of some countries, the traffic is often meager, and the classical approach to PCL processing is useless even with good coverage of the base stations.Such a scenario is typical for 5G network-based passive radars in rural areas.
A specific use case for short-range passive radar can be detecting vehicles or smuggler drones in border areas.These are usually rural areas, where base stations are deployed less frequently and can emit higher signal power resulting in greater detection range.The network load is typically low.Such base stations usually operate with a lower carrier frequency, gaining better forest and foliage penetration abilities.Another case can also be detecting flying objects (including drones) in the vicinity of small airports (especially those belonging to aeroclubs).Here, similarly, we can expect less network traffic, and in this way, we can improve the safety of local air traffic.
The SSB synchronization block is sent in 5G NR by a base transceiver station (BTS) independently whether the content is present or not [8].The SSB is the only always-ON signal in the 5G network.It contains a broadcast channel that has to be detectable in the whole cell coverage area.When a BTS supports beamforming, multiple SSBs are sent.Each of them is a beam-specific signal.Together they form a synchronization signal burst [8].Therefore, one can implement the PCL using the 5G SSB pulse also, which makes the 5G-based radar system robust and capable of working all the time, not only during slots with dense downlink content.
In the literature, some works can be found on using telecommunication and broadcast signals for passive radar processing.
This work is licensed under a Creative Commons Attribution 4.0 License.For more information, see https://creativecommons.org/licenses/by/4.0/Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
For example, in [16], DVB-T, digital audio broadcast (DAB), and long-term evolution (LTE) signals were examined as illumination for passive radars and their ambiguity functions were used.However, the results presented in [16] and [17] have been limited to simulation and to DAB, DVB-T, and LTE standards only.The DAB, DVB-T, and LTE-based passive radar technology is nowadays a mature technology.This fact is confirmed by the many demonstrators developed for these bands and many operational radars offered by industries [18], [19], [20], [21].The concept of using 5G signals as an illumination source is a new one, still at the feasibility study and demonstrator level-far from the finished product [15], [22].The 5G illuminator signal structure requires further research on its characteristics and structures to confirm that this illumination can be used in future for passive radar technology [23].This article proposes a novel approach to the processing which has been validated using simulated signals as well as real measurements performed in an operational 5G network.
In this article, the authors propose to use the signal processing pipeline inspired by the passive radar using active pulse radars as a source of illumination [24], [25].Such a configuration uses an active radar emitting pulse waveform as a signal source, and a parasitic two-channel receiver gathering the reference pulses (with parameters unknown for the passive receiver) and the echoes reflected from moving targets.This concept significantly differs from the algorithm proposed by the authors in [15] where the PSS of the SSB was detected only and used for the frame synchronization, which was required for removing the uplink slots from the 5G time division duplex frame.In contrast, the overall signal processing chain proposed at present requires precise detection and reconstruction/resynthesis of the complete SSB signal, consisting of four different parts (e.g., PSS, SSS, DM-RS, PBCH), and using it for synchronization, matched filtering, and moving target indication (MTI) commonly used in active radars.Similar impediments regarding content-dependent transmission in passive radar have been discussed in the literature in the context of, e.g., Wi-Fi-based PCL [26], [27], [28], [29], [30], [31] where the downlink signal structure resembles the one in the 5G network.Namely, synchronization bursts are transmitted periodically, but the downlink signal depends on the presence of terminals and the amount of data being downloaded.Therefore, PCL-based signal processing outcomes are dependent on the signal duty factor, which makes this approach insufficient in some practical applications.Thus, the need for the continuous and content-independent operation of passive radar using a 5G network encouraged the authors to investigate the 5G signal structure, and the results are described in this work.Of course, the general approach of decoding a signal of opportunity, its resynthesis in the passive radar node, and usage for looking for echoes in a surveillance signal is very well known.However, to the authors' knowledge, no work has been published so far (till now) on the practical application of this technique using the SSB signal of the 5G NR waveform.
In summary, the main novelty of this article, compared to [15], is the use of the SSB as an illumination signal.This is done under the assumption that no other signals are present in the system.However, using the SSB as illumination requires its detection and reconstruction in the "passive radar node."Since detailed knowledge about the difficult SSB morphology is needed for the realization of this task, a description of different SBB parts and their consecutive one-by-one synchronization and decoding takes up a significant part of the article.
The rest of this article is organized as follows.In Section II, the broadcasted 5G SSB signal used in this work is described.Next, in Section III, the classical passive radar processing is summarized that has significant drawbacks in 5G networks.In Section IV, the proposed signal processing pipeline is introduced.The simulations and real-life data processing are presented in Sections V and VI, respectively.Additionally, in Section V the authors show how to deal with the velocity ambiguity problem for a single target scenario.Finally, Section VIII concludes this article.

II. 5G NR AND SSB DETECTION
In this section, the morphology of the SSB synchronization signal, broadcasted in 5G, and step-by-step decoding of its separate parts, performed in "passive radar node," are carefully described.When the SSB is recognized, it can be digitally resynthesized in a passive radar and used as a reference signal for detection of its echos present in a surveillance signal.In order to make reading of the below telecommunication jargon easier, all used 5G acronyms are put together in Table I.The block structure of the SSB requires the sequential decoding of the signal in the following order (SSB parts one-by-one): PSS → SSS → PBCH DM-RS → PBCH.
The 5G NR standard is defined by the 3rd generation partnership project (3GPP) in 38 series [32], [33] and widely described in the literature, e.g., in [6] and [7].5G NR exploits the filtered orthogonal frequency division multiplexing transmission scheme.The NR signal is a sequence of symbols in the time domain, resulting from inverse fast Fourier transform (IFFT), filtered by a pass-band filter.Each symbol, interpreted as a block of grouped samples, is preceded with a CP, i.e., a copy of its last samples, used mainly for ISI suppression.A chain of a predefined number of symbols formulates a 5G NR frame (10 ms each).On the other hand, each subcarrier in this time-frequency resource grid can be used to transmit independent broadcast/control/data flows both in the downlink and uplink directions.In this research, SSBs, which are always "ON" 5G broadcast signals, are used as illuminators for object detection in passive radar technology.Such an approach is "green" since no extra signal generation is required.Another benefit of using SSBs as illuminators is their common coverage due to future worldwide deployment of the 5G NR standard.The statement "common coverage" shall be interpreted in such a way that at each point in the coverage area the received power level must be higher than the reference sensitivity power level (REFSENS) value according to Table 7.3.2-1 of the 3GPP TS 138 101-1.REFSENS is a UE receiver reference sensitivity power level.It depends on the operating band, channel bandwidth, and subcarrier spacing.Real-life measurements described in Section VI were performed in n77 operating band (3.4-3.8GHz), 40 MHz channel bandwidth, and 30 kHz SCS.In this environment, REFSENS is equal to −89.7 dBm.
In order to use the SSB in the passive radar processing chain, it has to be decoded and its signal has to be reconstructed.The structure of the SSB is specified in [8], [32], and [33].It is composed of PSS and SSS, DM-RS, and the PBCH.
The SSB structure is presented in Fig. 1.The standard [33] defines the SSB as a continuous block consisting of four OFDM symbols in the time domain and 240 subcarriers in the frequency domain.Synchronization signals PSS and SSS span 127 subcarriers over 1 OFDM symbol.SSBs are broadcasted in bursts in each 5G NR cell, in all beams every time interval T SSB dist = {5, 10, 20, 40, 80, 160} ms, depending on the configuration.The default, and most often used, SSB periodicity is 20 ms.However, if needed, it is possible to shorten it to 10 ms-thanks to this, one can achieve a wider velocity unambiguity in SSB-based passive radar.An exemplary sequence of SSB bursts, transmitted in one beam only, is shown in Fig. 2. The PSS signal is applied for SSB detection in the resource grid.It is a pseudorandom binary sequence (PRBS) generated using maximal-length sequences defined in Section 7.4.2.2.1 in [33].The 5G NR standard allows for the usage of only three unique PSS sequences, denoted as ID ∈ {0, 1, 2}.As shown in Fig. 1, the PSS is located at the forefront of the SSB in the time domain and around the SSB center in the frequency domain.A cross-correlation of a received signal, containing PSS, with the reference sequence defined in the standard, is the most efficient method of PSS detection [34].
The first step in the SSB decoding process is the estimation of: 1) ĝ-the correct GSCN position; 2) û-the PSS identifier N (2) where N CP denotes the CP length in samples and N FFT is the fast fourier transform (FFT) size.The estimation is being done according the following expression: where 1) x g r [n] is the received signal, shifted to the GSCN raster position (3000 + g • 1.44) MHz, g ∈ {0, 1, . .., 14756}see Section 7.4.2.2 in [32], and (•) * is the complex conjugate.
2) [33].By knowing ĝ, û, and n one can obtain the exact time and frequency position of the SSB and the corresponding N (2)

ID .
The SSS signal beginning is shifted by two OFDM symbols in the time domain compared with the PSS (see Fig. 1) and is generated with the use of Gold sequences according to Section 7.4.2.3.1 in [33].Its position is already known after time and frequency PSS synchronization.Therefore, its decoding process is less computationally demanding, which allows for the correlation of the FFT weights of the received signal containing SSS (X SSS [k]) with up to 336 different reference sequences denoted as N (1) ID ∈ {0, 1, . .., 335}.The result of the correlation allows one to estimate v-the SSS identifier N where 1) ID = v, see Section 7.4.2.3.1 in [33].Estimated IDs of transmitted PSS and SSS sequences are then used to calculate the physical cell identifier N cell ID N cell ID = 3N (1) ID . ( The PBCH occupies two OFDM symbols alone, and one symbol together with the SSS (Fig. 1).The resources of all three PBCH OFDM symbols are also mixed with DM-RS.Since DM-RS is used in different 5G channels in this article, the DM-RS of PBCH is denoted as PBCH DM-RS.The DM-RS mapping pattern is cell and beam specific and, according to Table 7.4.3.1-1 of [33], it depends on the physical cell identifier N cell ID , calculated using (3), and the SSB/beam identifier i SSB .The value of i SSB is found by calculation of a cross-correlation coefficient between a cut out PBCH DM-RS X DM-RS [k] and the reference PBCH DM-RS PRBS d DM-RS i , generated according to Section 7.4.1.4.1 of [33] Finally, knowing N cell ID and i SSB , we can decode a PBCH payload.The possible location of symbols X DM-RS [k] is specified in Table 7.4.3.1-1 of [33].Our aim is to obtain the transport block of the BCH.After X PBCH [k] QPSK demodulation and descrambling (Section 7.3.3 of [33]), we can apply a processing chain of BCH error correction and decoding according to Section 7.1 of [35].This step ends the SSB decoding procedure.The decoding algorithm described in this section works as long as the SSB can be detected within a given 5G cell range.The noise level that prevents exact reconstruction depends on many factors, such as receiver noise figure, signal-to-interference-and-noise ratio (SINR) at the receiver input and applied detection algorithm.In this article, it was assumed that in order to decode the SSB properly, SNR > 0 dB is necessary.From the 5G network perspective, the minimum power levels necessary for SSB demodulation are always assured in the whole area under network coverage.
After the reception and decoding of the SSB, it is possible to reconstruct it and to obtain a signal that is equal to the originally transmitted one.Firstly, PSS and SSS synchronization signals are appropriately generated using the found values of N (2)

ID and N
(1) ID .Next, the cell and beam specific PBCH DM-RS bits are generated in a 5G time-frequency OFDM grid based on N cell ID and i SSB .The detected i SSB is used to imitate the detected beam.This value can be changed to reconstruct different beams if they are present.Then, making use of the decoded transport block and BCH processing, the desired code block is obtained.The scrambling process returns the PBCH payload.The BPSK modulation is applied for synchronization and reference signals (PSS, SSS, and DM-RS), and the QPSK modulation for the PBCH payload.Then, all data are mapped to their dedicated positions in the SSB being synthesized (X SSB [l, k], where l is the OFDM symbol and k is the subcarrier).The precise moment of the SSB start is given to the SSB-based passive radar procedure, which simplifies the phase alignment process described in Section IV.As will be shown in Sections V and VI, the usage of the reconstructed and synchronized SSB in 5G-based passive radar allows for robust object detection.A similar albeit simpler description of the SSB morphology can be found in [15].At present, it is given in a more detailed form in order to offer completeness to this presentation.
The 5G signal analysis and SSB signal reconstruction pipeline applied in this work is presented in Fig. 3.The signal from two antennas has to be received for passive radar purposes.The reference channel signal x ref [n] is obtained from the first antenna directed toward the 5G BTS.The surveillance signal x sur [n] comes from the second antenna which observes the area where the presence of a target is expected (the geometry is described more precisely in Section III).For appropriate signal demodulation and reconstruction, signals from both channels must be resampled and synchronized.Frequency synchronization is carried out in two channels to preserve their common dependencies, allowing for signal detection which would be impossible when only one of them was shifted in frequency.Then, operations are carried out only on the reference signal aiming at the SSB extraction from it.Then, the SSB position is detected, according to (1), and the PBCH symbols are decoded.Finally, having the SSB detected, its IQ time signal is synthesized back (remodulated) as x SSB [n] = CP IFFT X SSB [0, :] ,. ..,CPIFFT X SSB [3, :] (5) where CP(•) adds a CP to the modulated OFDM symbol, and IFFT(•) is the inverse Fourier transform operator.In this way a perfect time-domain SSB reference is obtained, which is further used in the passive-radar signal processing pipeline described next.Theoretically, it is possible to use only a reference signal x ref with minimal or even no content to create a matched filter (omitting all the described blocks).However, in such a case we will be dealing with unmatched filtering, which will degrade the effectiveness of the entire system.This topic is discussed in more detail in Section IV.
In the 5G SSB-based passive radar approach proposed in this article, SSBs are exploited for moving object detection which is described in Section IV.A rationale behind using the SSB in passive radar is its noise-like character that favors applying such a kind of waveform in radar tasks.In the literature, the problem of waveform correlation properties has been addressed extensively, e.g., [16], [17], [36].Generally, the ambiguity function of the radar waveform of opportunity should be characterized by a strong peak for zero delay and zero frequency shift, and sidelobes as low as possible to obtain a high range and Doppler resolution.The ambiguity function of the 5G SSB signal is shown in Fig. 4. We can observe excellent properties of the SSB waveform: Offering a dynamic of ∼ 30 dB which is typical for pulse signals exploited in radar systems.Objective measures proposed for the Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.evaluation of cross-ambiguity function quality in passive radar applications are presented in [16] and [17].
The necessity to reconstruct the entire SSB results from the correlation properties of the signal waveform.Let us remember: The block structure of the SSB requires the sequential decoding of the signal in the following order: PSS → SSS → PBCH DM-RS → PBCH.The occurrence of an error in the decoding of any of the elements prevents further SSB reconstruction, which worsens the dynamics of the signal from the radar perspective.To represent the SSB correlation properties with a matched filter containing selected portions of the signal, three parameters of the ambiguity function were used as follows [17].
1) Cross-ambiguity function of the signals x(t) and y(t) [self-ambiguity function (SAF) refers to the case when x(t) = y(t)], given as In this example, if x(t) = y(t), the first signal is the whole, perfectly reconstructed SSB according to (5), and the second is the version of the SSB with some components (e.g., PBCH, DM-RS, etc.) removed that may have resulted from incorrect decoding during the reconstruction process.The signal y(t) can be resynthesized by removing parts of the complex SSB grid in X SSB [l, k], then the waveform is generated using (5).2) Integrated sidelobe level (ISL) computed as an integrated (6) with a removed peak at ξ(τ = 0, f = 0)1 and after distribution normalization to the maximum value of the SSB's SAF.

III. CLASSICAL PCL PROCESSING
A typical passive radar configuration has a bistatic geometry, with a noncooperating transmitter (T x ) and a radar receiver, spaced significantly far from each other (see Fig. 6).The transmitter emits a wave that reaches the radar both directly (path length is L) and indirectly (path length is R 1 + R 2 ) by reflecting from targets or terrain obstacles.The bistatic range is then given as   Then, the surveillance signal is filtered in order to remove from it the leakage of the direct signal and the echoes coming from stationary targets or terrain obstacles.This operation is usually performed by means of adaptive filters.The next step is to determine the range-Doppler (RD) map on which target detection is based.It is usually done by calculating the CAF, defined as [2] Ψ where m = 0, . . ., M − 1 is an integer number corresponding to a signal delay in samples, k = 0, . . ., K − 1 is an integer number corresponding to a frequency shift expressed in frequency bins, and N is the number of samples of the reference signal and surveillance signal (assuming equal length of both signals).M and K are the number of samples corresponding to the maximum value of the bistatic range and the bistatic velocity of the target, respectively.
Further steps of the classical PCL processing algorithm are as follows: The CAF is thresholded to obtain target detections.The parameters of the targets are estimated, and tracks are created based on the obtained radar detections.
For proper operation, in general, passive radars require at least the following two receiving antennas: 1) one channel is used to acquire a reference signal; 2) the other is used to acquire surveillance signals.Typically, antenna arrays are used here, allowing multiple beams to be created digitally [37].However, when working with digital signals such as DVB-T or GNSS, e.g., it is possible to obtain the reference signal without having a separate receiving channel for this purpose simply by performing decoding of the DVB-T bitstream and remodulating/synthesizing it back [38].Thus, in an extreme case, a PCL system can be created based upon a single channel receiver [39], [40].
However, in the case of the 5G standard, it is not possible to completely decode and reconstruct the whole signal.One can resynthesize the SSB, however, using the SSB alone as a reference signal is not always possible due to duration being too short.This has been confirmed during simulations (see Section V).The passive radar processing scheme, based on active radars, described in Section IV, is free of this disadvantage.This idea, namely an SSB-based 5G passive radar, represents the main achievement of this article.

IV. SSB-BASED PASSIVE RADAR SIGNAL PROCESSING
As mentioned in Section I, the signal processing chain in the proposed SSB-based 5G passive radar is inspired by the similar techniques used by PCL utilizing noncooperative active radars as illuminators.This approach has been addressed in the literature several times and applied in classical target detection [24], [25], [27], [28] and imaging [41], [42], [43].As shown in [25], such processing differs from the classical PCL one mainly in the replacement of the cross-ambiguity function by the matched filtering (range compression) of the surveillance signal by the reconstructed pulse, followed by phase alignment.In passive radars using noncooperative active radars as an illumination source, the main problems are as follows: 1) The receiver may not know the precise moment in which the pulse starts, resulting in wrong phase synchronization and incorrect detection.Hence, accurate time synchronization is necessary to make a passive radar work appropriately [24].
Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.2) Pulse radars usually use varying waveforms which refer to amplitude, phase, carrier frequency, and chirp rate.An ideal model is typically unknown when considering noncooperative radars; thus, in the receiver, only the estimate can be considered with no guarantee of its quality [44].In the considered case, when the 5G SSB signal is treated as a pulse from the noncooperative transmitter, one can receive, demodulate, and remodulate (reconstruct) the waveform to the pure form.Moreover, due to the standardized formula describing the SSB [8], [32], [33], one can define the pulse start with a single sample precision, eliminating the problem of finding pulse beginning.Thus, the authors obtained both frequency and time synchronization in this work due to reference signal reconstruction that is fundamental in the PCL system.
A justification of the SSB pulse reconstruction is presented for two practical scenarios shown in Fig. 7.The first analyzed case presented in Fig. 7(a) concerns the dynamics of the crosscorrelation function of signals x(t) and y(t) given by the formula In the study, two SSB pulses with different SNR levels are correlated, and their level is written in the subscript in Fig. 7.For a clean waveform without noise, it is assumed that SNR = ∞ dB.
The results clearly show that the reconstruction promotes signal detection and significantly affects the echo detection ability.The better the quality of the reference pulse, the lower the noise floor of the cross-correlation function, and the best properties are obtained for an accurately reconstructed signal.In the worst presented case of χ (0,0) , i.e., for (0 dB, 0 dB), the noise peaks are even higher than its sidelobes.When comparing χ (0,0) and χ (∞,∞) the difference between the noise floor levels is about 15 − 20 dB.The second example in Fig. 7(b) shows the real-life signal after matched filtering (discussed later in this section).Accurate timing is only possible by detecting, demodulating, and reconstructing the SSB.Finding the beginning of the pulse in the signal from the reference antenna allows one to study the time dependencies of the observed objects and precisely determine their velocity.This is because phase alignment is correct when you know where the pulse starts [the red vertical line in Fig. 7(b)].In the presented case, the signal resulting from multipath propagation is stronger than the direct pulse.This complicates the timing and requires the reconstruction mentioned above.
After the time synchronization process, one can create the 2-D matrix in which one dimension corresponds to the range (N samples) called fast time [24].Assuming that the distance between the two consecutive SSBs equals T SSB dist , the second matrix dimension (slow time) expresses time depending on the number of SSBs considered in the processing (M = T int /T SSB dist samples, where T int is the integration time and • is the round down operator).The range-time matrix is then created as a convolution of the surveillance channel signal xsur where a primary operation is a convolution (typically performed using the FFT algorithm) Therefore, the matched filter is the reversed in time and conjugated SSB signal reconstructed as presented in Section II.A complete range-time map R[n, m] consists of a set of rangecompressed signals arranged for each consecutive SSB with the index m.The general idea of the range-time map creation is presented in Fig. 8.The next step of the algorithm is the phase alignment defined as [41] R where where (•) stands for the angle operator.To suppress the clutter and distinguish the echo from stationary reflections, one must perform an MTI processing along the observation time.Clutter cancellation consists of high-pass filtering along the slow time Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.m for each range cell n.The operation can be written as follows: where w[n] is a high-pass filter.The final operation is the Fourier transform along the slow time for each range cell, so that where F{•} is the discrete Fourier transform computed using the FFT algorithm, and k ∈ [0, K − 1] denotes frequency bins (interpreted as a Doppler shift calculated to V b ).Next, the detection and estimation algorithms are applied prior to tracking.The general concept of the algorithm is depicted in Fig. 9.
In passive bistatic radars using frequency modulated signal of opportunity, assuming a matched filter output equal to 1, one can obtain bistatic range resolution defined as [(2.8) in [2]] where c is the speed of light, B is the signal bandwidth.In considerations in the sequel of this work, B = 61.44MHz [15].The Doppler range is limited by T SSB dist so that (16) where the wavelength λ = c f c , and f c = 3.44 GHz is the carrier frequency for the 5G network used in the experiment.
The ambiguity in velocity estimation is a problem in active radars [45].A moving target introduces a frequency shift in the signal received by the radar which is estimated by means of a Fourier transform performed for each range cell along the slow time.Thus, pulse repetition frequency corresponds to the sampling rate in the Doppler-shift domain.The higher the pulse repetition frequency, the wider the unambiguous velocity range, stemming from the Nyquist sampling theorem.As can be deduced, assuming the default value of T SSB dist = 20 ms and for the given carrier frequency, one can obtain the maximum unambiguous bistatic velocity of ±1.0901 m/s.For higher velocities aliasing occurs, preventing the unambiguous measurement of velocity.This is a major 5G SSB-based passive radar limitation that can be mitigated by T SSB dist manipulation.The SSB periodicity can be decreased to the minimum value when a cooperative network is considered.For instance, in the case in question, for T SSB dist = 5 ms one can obtain the maximum unambiguous bistatic velocity of ±4.3605 m/s which can be sufficient in some applications.The 5G standard also assumes lower frequencies utilization, e.g., n28 band (703 − 748 MHz uplink / 758 − 803 MHz downlink), allowing wider unambiguous Doppler frequencies to be obtained.Also, for a rural environment when the downlink transmission is supposed to be low, or even no transmission is expected, any passive detection can be useful when the typical PCL processing fails.As mentioned in Section I, such a scenario is often common near countries' borders.Therefore, for a cooperative 5G network, the SSB periodicity can be increased when any moving target is detected, assuming its velocity is aliased.
Single-snapshot velocity estimation when analyzing under Nyquist criterion signal sampling is challenging, but a simple solution for unambiguous velocity estimation using two RD maps is proposed in this article.Let us assume a single-target scenario as in Fig. 10.If some assumptions can be made, e.g., relatively constant velocity, one may write the velocity as where N ∈ Z describes how many times the velocity is aliased, and (18) where the sign depends on the target direction with respect to the radar.Of course, (17) holds true if during Δt the target velocity obeys N = const.which can be adopted in simplified shortrange applications.As a result, one may write the linear system as follows: From ( 19) we get V max (20) equation ( 20) determines the unambiguous velocity given in (17).By using three RD maps, one can simply estimate an acceleration and nonlinear velocity extending the relationships given in this section.However, it has to be kept in mind that the presented considerations are valid for a single target.The appearance of an additional one prevents the use of this approach exactly as it was presented and requires more complicated analysis.For example, the Doppler shift can be estimated using a bank of filters in the surveillance channel.Such an approach resembles Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.that proposed in [44], where the carrier frequency of a radar pulse was estimated in this way.In the case of 5G signals, a filter is a reconstructed SSB pulse with a carrier frequency shift from a given set (considered as a set of Doppler shifts).Passing the received signal through the filter bank and extracting maximum peaks provides the Doppler with a frequency shift estimate.This method, however, is more computationally demanding but allows for multiple target velocity estimation.Another solution to this challenge could be employing a compressed sensing technique [46].Such methods can determine the parameters of signals sampled below the Nyquist criterion.

V. SIMULATIONS
The proposed SSB-based 5G passive radar technique was experimentally validated using simulated data at first.The following three 5G network scenarios were assumed: 1) full downlink allocation; 2) partial downlink allocation; 3) lack of downlink transmission.The signal was generated using a vector signal generator.
The simulation scenario assumed a target signal with an amplitude equal to −40 dB when compared to the reference one.The bistatic range was R b = 100 m and the bistatic velocity V b = 12.5 m/s.This configuration reflects the actual conditions under which, e.g., a moving car is observed during a measurement campaign [15].It has to be stressed that the velocity ambiguity will occur for the SSB-based method but this problem can be solved as described before.However, the performed simulation aimed to compare only the possibility of detecting a target (even with an incorrect velocity estimate) with varying downlink content levels.Additionally, stationary targets were added to simulate the communication channel existing in real-life situations.The computation was carried out for each signal case using the classical PCL processing and the proposed SSB-based technique.For the classical PCL processing, T int = 20 ms, and for the proposed technique T int = 0.5 s which stems from a totally different processing pipeline and requires more pulses to be gathered.The outcomes for each case are depicted in Fig. 11.
In line with expectations, the CAF goes bad with content reduction.The target is clearly visible at the range and velocity conditioned in the simulation for the full downlink allocation.However, when reducing the illuminating signal duration, the target disappears from the CAF, making detection impossible.This is not the case for the proposed SSB-based processing method when the target is apparent independently of the content presence.Certainly, since unequivocal velocity estimation is feasible only for ±2.1802 m/s, the appropriate value was impossible to be achieved and the estimated velocity is incorrect.The problem is illustrated in Fig. 12.However, the target can be detected at an appropriate bistatic distance compared to the CAF results, where no object can be seen.The results suggest the way the 5G-based passive radar should work.Namely, SSBbased processing should be performed continuously, allowing for target detection even without a downlink signal.The classical PCL approach should be the primary processing core when the content occurs due to more precise velocity estimation.
The problem can be overcome by the approach proposed in Section V and derived (20).Assuming the constant bistatic target velocity V = 12.5 m/s, one can compute several RD maps for integration time T int = 0.5 s.Let us consider two of them separated by Δt = 4 s, T SSB dist = 10 ms, and f c = 3.44 GHz.The results are depicted in Fig. 13.Assuming R 1 = 100 m, R 2 = 150 m, Ṽ1 = Ṽ2 = −0.5815m/s and substituting these values to (20), one has N = 3 which coincides with the true value (see Fig. 12).Substituting appropriate values to (17), the precise unambiguous velocity was estimated.
Additionally, as the percentage of content in a 5G frame decreases, the power of the overall signal decreases also.This can have a negative impact on the detector performance for SSB-based processing.Table III shows the SNR values of the target for the situation presented in Fig. 11(g), (h), and 11(i).The noise level was estimated for such a portion of the RD Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.map where neither the target nor its sidelobes are present.The SNR difference between the case of full content allocation and no content is 4.23 dB.This affects the maximum radar detection range, however, the SNR of the target still remains very high (39.41dB) and target detection is possible in each scenario.
The level of sidelobes in Fig. 13 in the first range cell is worth noting.The direct signal appearing in the surveillance channel generates a great peak after correlating the signal with a reconstructed SSB pulse.According to Table II, this peak has a relatively high sidelobe level.To remove the direct signal entirely from the surveillance channel, one has to use a high-pass filter with a sufficiently high stopband frequency.The side effect is that the filter can also remove the desired echoes from the target.Thus, the filter parameters are a tradeoff between direct signal removal and the possibility of slow-moving target detection.

A. Trials
The measurements aiming at proving the correctness of the proposed findings were carried out at the campus of the Łódź University of Technology, Poland, similarly as in [15].The measurement setup is illustrated in Fig. 14, and the developed passive radar demonstrator scheme is depicted in Fig. 15.The electronic elements of the receiving path were commercialoff-the-shelf components.The signal was recorded using the Ettus USRP X310 SDR platform, synchronized by GPS time reference.Data storage was performed using a computer with an Intel Core i7-9700 2.66-GHz processor, 32-GB RAM and SSD drive, and Ubuntu 18.04 operating system.The measurement scenario is presented in Fig. 16.The cooperative target was a car (Volvo XC90) moving in a parking lot illuminated by the BTS [15].The car was equipped with a GPS recorder.Thanks to this, the bistatic range and velocity of the target could be calculated in postprocessing.The measurement was carried Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.out for two configurations, which were conducted during two separate measurement campaigns.The experiment examined the possibility of detecting the target in the presence of the downlink content, and without it, with the use of SSBs only.The main differences between these two situations can be viewed in Figs. 2  and 17.As is apparent, when the terminal is downloading the data, the signal covers the whole bandwidth and only some slots are dedicated for uplink transmission.Only the SSBs are visible for the case of no transmission, which disqualifies the classical PCL processing described in [15], as shown in the further part of this work.During the trials, the beamforming was turned OFF to facilitate algorithm validation using a single receiving station.

B. Presence of Content
The results showing classical PCL processing outcomes in 5G-based passive radar were presented in [15] for the high network traffic case.The processing was carried out when the base station was transmitting a vast amount of data.At the same time, the SSBs were also propagated as a fundamental part of the 5G signal structure.In this case, the T SSB dist = 20 ms, which is typical for the network exploited in the experiment.The signal was processed through both the classical PCL pipeline and the proposed SSB-based one, presented in Section IV.The results in the form of RD maps for these two methods are illustrated in Fig. 18.The integration time was the same as in the simulations, namely T int = 20 ms for the CAF-based processing, and for the one based on SSBs, T int = 0.5 s.As can be seen, the target is clearly visible at the range of R b = 100 m.Since the SSB periodicity was limited to a typical value of 20 ms, the authors obtained a narrow unambiguous Doppler shift range.However, the target distance was correctly estimated at ca. 100 m, and the results from the two methods coincide.The correctness of the proposed method can be questionable in this case, but the next section illustrates the outcomes for a situation where there is a lack of content.

C. Lack of Content
In this case, the SSB periodicity was two times higher than in Section VI-B, reducing the SSB interval to T SSB dist = 10 ms-the value allowing the obtaining of the maximum unambiguous bistatic velocity of ±2.1802 m/s.During the experiment, none of the terminals were connected with the network.Hence, only SSBs were sent periodically every 10 ms, as presented, e.g., in Fig. 2. The measurement scenario was identical to Section VI-B, and the same cooperative target was considered.Also, the integration time was identical to the previous case.The outcomes are depicted in Fig. 19.The results show the principal difference between the usability of the classical PCL processing and the proposed method.The RD map computed employing the CAF is useless for no downlink transmission.Using the proposed SSB-based processing, the target was detected at ca. 130 m, which was confirmed with the data collected by the GPS logger placed in the car.Even for Doppler velocity aliasing, making the correct velocity estimation impossible, the range estimation was correctly carried out.Through, e.g., decreasing T SSB dist in a cooperative 5G-network, the Doppler range can also be increased.Another possibility is to apply the technique proposed in Section IV relying on velocity estimation based on two RD maps.The method can be applied as in the present case: A car was observed moving at a constant velocity over a short distance; thus, the assumption N = const.can be applied here.The constancy of bistatic velocity can also be assumed in the analyzed case, since for a bistatic range of 130 m, where target detection occurred, the change in bistatic velocity over the analyzed time period is of the order of 0.08 m/s.The results are illustrated in Fig. 20 and were obtained within the same measurement as in Fig. 18 (f c = 3.44 GHz, Δt = 3 s, V max = 2.18 m/s) for the scenario marked as a red arrow in Fig. 16.Therefore, the GPS data and classical PCL processing can confirm the method's correctness.The same moving target as in the previous experiments was detected twice, giving R  The results presented in this section confirm the correctness and utility of the proposed method, especially when considering the 5G network as an illuminator in a rarely inhabited area when a lack of content is common.

VII. DISCUSSION
Although reference signal reconstruction is a typical way of improving passive radar performance, the proposed technique requires additional processing steps to make the radar able to detect targets.The reference signal reconstruction is not obligatory but typically increases the SNR.Reference signal reconstruction is well established in the literature, and the process itself is mature.In works related to DVB-T (and similar standards), one can assume a continuous transmission, and the signal is reconstructed continually.In passive radars using pulse signals as a source of illumination, another crucial aspect must be comprised and distinguishes the proposed method from stateof-the-art techniques.One needs to know the pulse position accurately in the reference and surveillance signals.Without this step, we cannot precisely determine the target's position and velocity.The position and phase of the reconstructed pulse allow for the phase alignment described in Section IV.The RD map is exact when the phase is correctly aligned, i.e., when the pulse position is determined with a single sample precision as shown in Fig. 7.If the pulse is reconstructed correctly, one can precisely estimate its position in the reference and surveillance Let us present the processing results of the same signal part with and without phase alignment to express how essential this operation is.Fig. 21 illustrates the RD maps obtained for the signal with and without an aligned phase.Clearly, the target can be detected only after the phase alignment operation.Omitting this step leads to the imprecise determination of target position and velocity or the inability of its detection.This is the main difference between the pulse-based passive radar and typical processing used when working with, e.g., DVB-T signals.This factor makes the proposed approach different than typical signal reconstruction in passive radars.Another difference is that pulse radars (both passive and active) suffer from the problem of ambiguity in velocity estimation.In the discussed experiment, the velocity was from the range of ±2.18 and ±1.09 m/s depending on T SSB dist .The problem can be illustrated for the whole range of SSB pulse periodicity and frequencies in 5G networks.Generally, the full scope of possible unambiguous velocities is listed in Table IV.As can be seen, SSB-based processing is promising for lower frequencies where additionally, higher powers are usually available.

VIII. CONCLUSION
This article has addressed the issue of target detection in short-range passive radar using 5G synchronization and broadcast signals as a source of illumination.The superiority of the proposed findings relies on the possibility of target detection for a lack of downlink signal transmitted in the network.The outcomes show that when the classical passive radar processing based on CAF computation fails, the proposed approach allows one to obtain satisfactory results of range detection.However, due to the relatively low synchronization pulse transmission frequency, ambiguity in velocity measurement occurs.How to solve this problem was shown under the assumption that the moving object velocity is approximately constant.Nevertheless, without downlink transmission, the classical PCL method is blind.Thus, the SSB-based passive radar using a 5G network can be a complementary subsystem allowing for target detection (being aware of possibly incorrect velocity estimation) in typical applications.
In the future, the authors plan to develop a data fusion algorithm for target detection and tracking from the following two signal processing chains: 1) the proposed one; 2) the typical CAF-based type.Also, the research will be focused on other pulsed-nature signals existing in 5G transmission when the content is insufficient to perform a comprehensive signal integration.Still, these signals may support the method using SSBs and consequently increase unambiguous velocity when appropriately reconstructed.A challenging scenario also has to be addressed-namely, target detection with operating beamforming in a 5G network.The forthcoming systems will almost always be deployed with multiple beams to increase network functionality and spectrum management.This raises problems with, e.g., reference signal acquisition when the beam illuminating a target is not reachable by the reference antenna in a single-receiver passive radar.The subsequent problem worth considering is small target detection, for instance, drones whose reflectivity is significantly lower than the car used in the experiment.

( 1 )
ID according to theAuthorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
These waves are received by the surveillance and reference antennas, giving signals x s and x r , respectively.Then, signals are processed by a coherent receiver where they are initially digitized, resulting in signals x sur and x ref .When the radar has multiple antennas, the reference and surveillance signals can be obtained using beamforming techniques.

Fig. 5 .
Fig. 5. Comparison of the CAF for the full SSB and its parts.(a) CAF of the PSS and the full SSB.(b) CAF of the PSS+SSS and the full SSB.(c) CAF of the PSS+SSS+PBCH DM-RS and the full SSB.

Fig. 7 .
Fig. 7. Rationale of the SSB synchronization.(a) Cross-correlation of the SSB with different SNR levels expressed in decibels.(b) Time and phase synchronization -real-life signal visualization.

Fig. 11 .
Fig. 11.Comparison of the classical PCL processing using the CAF function and for the proposed SSB-based technique using the RD map in different simulated scenarios.The dynamics scale on all CAF and RD maps has been limited to 20 dB.(a) Spectrogram for the fully allocated downlink.(b) Spectrogram for the partially allocated downlink.(c) Spectrogram for the lack of downlink transmission.(d) CAF for the fully allocated downlink.(e) CAF for the partially allocated downlink.(f) CAF for the lack of downlink transmission.(g) RD map for the fully allocated downlink.(h) RD map for the partially allocated downlink.(i) RD map for the lack of downlink transmission.

Fig. 12 .
Fig. 12. Graphical interpretation of the ambiguity problem in velocity estimation in pulse radars with values corresponding to the simulation.

Fig. 13 .
Fig. 13.Two RD maps for the simple movement model.(a) RD map for t 1 .(b) RD map for t 2 .

Fig. 16 .
Fig. 16.Measurement scenario.Empty circle-the 5G base station location, filled circle-the recorder position, red arrow-the trajectory of the car movement in the case of content presence, black arrow-the trajectory of the car movement in the case of lack of content, the car-cooperative target, shown in the upper-right corner.

Fig. 17 .
Fig. 17.A real-life 5G transmission in the time-frequency domain.An opposite situation for lack of downlink transmission was presented in Fig. 2.

Fig. 18 .
Fig. 18. Results of the processing for the classical PCL approach and the proposed one for a transmission full of downlink content.(a) RD map for the classical PCL processing in the presence of content.Target SNR is 29.67 dB.(b) RD map for the proposed SSB-based PCL in the presence of content.Target SNR is 19.9 dB.

Fig. 19 .
Fig. 19.Results of the processing for the classical PCL approach and for the proposed one when no data were downlink-transmitted. (a) RD maps for the classical PCL processing for lack of content.(b) RD map for the proposed SSB-based PCL for lack of content.Target SNR is 17.96 dB.
1 = 53.6738m, Ṽ1 = 0.6365 m/s, R 2 = 97.5887m, and Ṽ2 = 0.5340 m/s.Substituting values to (20) yields N = 6, V 1 = 13.72 m/s, and V 2 = 13.61m/s.At the same time, the classical PCL processing with integration time T int = 20 ms gave V = 16.3 m/s.Slight discrepancies result from a simple target movement model and the limited velocity Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.

Fig. 20 .
Fig. 20.Real-life RD maps for t 1 and t 2 .(a) RD map from the real-life experiment for t 1 .Target SNR is 24.98 dB.(b) RD map from the real-life experiment for t 2 .Target SNR is 19.9 dB.

Fig. 21 .
Fig. 21.Comparison of the processing results with and without phase alignment operation.(a) RD map after phase alignment operation.(b) RD map without phase alignment.TABLE IV UNAMBIGUOUS VELOCITY (IN [M/S]) FOR DIFFERENT CARRIER FREQUENCIES f c AND THE SSB PERIODICITY T SSB DIST