Project

General

Profile

Cell Broadcast » History » Version 10

laforge, 09/09/2018 03:55 PM
add instructions on how to use current SMS-CB / CBCH support

1 1 laforge
h1. Cell Broadcast
2 7 fixeria
3 7 fixeria
{{>toc}}
4 1 laforge
5 1 laforge
Normally, all user plane data in GSM/GPRS networks are sent in point-to-point channels from the network to the user. Those are called "dedicated" radio channels whcih exist between the network and one given phone/subscriber at a time.
6 1 laforge
7 1 laforge
Cell Broadcast is an exception to that rule.  It permits user data (so-called SMS-CB data) to be broadcast by the network in a way that can be received by all phones in the coverage area of the given [[BTS]] simultaneously.
8 1 laforge
9 1 laforge
More high-level information can be found at https://en.wikipedia.org/wiki/Cell_Broadcast and the related specification is found at "3GPP TS 23.041 Technical realization of Cell Broadcast Service (CBS)":http://www.3gpp.org/ftp/Specs/html-info/23041.htm
10 1 laforge
11 2 laforge
h2. Use Cases
12 1 laforge
13 2 laforge
Cell Broadcast was used for various different use cases primarily in the 1990ies and early 2000s, including
14 2 laforge
* advertisement of the GPS position of the cell tower you're currently camping on
15 2 laforge
* advertisement of the calling codes of your current "home zone", i.e. a "lower cost short distance" call zone travelling with you as you roam around.
16 2 laforge
17 2 laforge
More recently, SMS-CB is seeing some uptake by various desaster warning systems, such as
18 2 laforge
* CMAS (Commercial Mobile Alert System), later renamed to WEA ("Wireless Emergency Alerts":https://en.wikipedia.org/wiki/Wireless_Emergency_Alerts) in the US.
19 2 laforge
* EU-Alert in the European union
20 2 laforge
* Messer Ishi (Rocket Alert) in Israel
21 2 laforge
* ETWS (Earthquake and Tsunami Warning System) in Japan
22 2 laforge
* KPAS (Korean Public Alert System)
23 2 laforge
24 10 laforge
h2. Osmocom Cell Broadcast support
25 1 laforge
26 6 laforge
* [[OsmoBTS:]] implements the "SMS BROADCAST COMMAND" Message in RSL according to Section 8.5.8 of 3GPP TS 08.58 *but not all hardware targets support this yet, see #1617. osmo-bts-sysmo and osmo-bts-octphy are fine.*
27 1 laforge
* [[OsmoNITB:]] and [[OsmoBSC:]] implement a VTY command @bts <0-255> smscb-command <1-4> HEXSTRING@ to send a given hex-formatted cell broadcast message to a specified BTS
28 8 laforge
** you (obviously) first need to enable a timeslot/channel combination on the BTS that actually includes a CBCH, i.e. ccch+sdcch4+cbch or sdcch8+cbch
29 1 laforge
30 4 laforge
!osmocom-cbs.png!
31 4 laforge
32 2 laforge
This is sufficient for manual transmission of cell-broadcast messages in a lab environment or in small networks.  The functionality has been developed and "used at the 31st annual CCC congress (31C3) to deliver spoofed _Presidential Level Alert_ messages":https://twitter.com/2b_as/status/549695235207737344/photo/1
33 1 laforge
34 10 laforge
h3. How to test/use it
35 10 laforge
36 10 laforge
You need to perform two steps:
37 10 laforge
38 10 laforge
h4. make sure your related BTS is configured to use a channel combination with CBCH
39 10 laforge
40 10 laforge
For using a combined CCCH with SDCCH/4 and CBCH you can use the following example snippet as part of osmo-bsc.cfg:
41 10 laforge
42 10 laforge
<pre>
43 10 laforge
network
44 10 laforge
 bts 0
45 10 laforge
  trx 0
46 10 laforge
   timeslot 0
47 10 laforge
    phys_chan_config CCCH+SDCCH4+CBCH
48 10 laforge
</pre>
49 10 laforge
50 10 laforge
h4. telnet to osmo-bsc at port 4242, and enter something like
51 10 laforge
52 10 laforge
<pre>
53 10 laforge
enable
54 10 laforge
bts 0 smscb-command 1 001000320f1141660c344dd3cba09a0c
55 10 laforge
</pre>
56 10 laforge
57 10 laforge
where "1" is the number of blocks required (each 22 bytes need one block)
58 10 laforge
and the hex-dump at the end is the encoded GSM 04.12 message to be broadcast.
59 10 laforge
60 1 laforge
h3. What's missing (for production operation in larger networks)
61 1 laforge
62 1 laforge
* mechanism to broadcast one (set of) cell broadcast messages from the BSC to multiple/all BTSs, rather than one BTS individually
63 1 laforge
* BTS reporting of current CBCH load
64 1 laforge
* BSC scheduler scheduling multiple alternating sets of CBCH messages based on the current CBCH load reported by BTS
65 10 laforge
* external interface from BSC to a Cell Broadcast Center (CBC), e.g. according to 3GPP TS 48.049 (CBSP)
66 1 laforge
* an Osmocom implementation of the Cell Broadcast Center (OsmoCBC) which can manage and dsitribute messages to multiple BSCs and which has an external interface by which cell-broadcast can be entered into the network
67 10 laforge
68 10 laforge
69 10 laforge
70 3 laforge
71 2 laforge
h2. Message Structure
72 2 laforge
73 2 laforge
* Message has maximum 15 pages
74 2 laforge
* Each page is 82 bytes of data, resulting in 93 characters in GSM 7-bit default alphabet
75 2 laforge
* Messges are broadcast on logical channels (more like an address)
76 2 laforge
* Subscribers can activate/deactivate selective addresses
77 2 laforge
78 2 laforge
h2. Further Reading
79 2 laforge
80 2 laforge
* ITU-T SG2 (Standardization of CB Channels)
81 2 laforge
* 3GPP TS 23.041 Cell Broadcast
82 2 laforge
* ETSI 102 444
83 9 laforge
* "3GPP TS 23.041 GSM: Technical realization of Cell Broadcast Service (CBS)":https://www.etsi.org/deliver/etsi_ts/123000_123099/123041/15.02.00_60/ts_123041v150200p.pdf
84 9 laforge
* "3GPP TS 48.049 GSM: Baste Station Controller - Cell Broadcast Centre (BSC-CBC) interface specification; Cell Broadcast Service Protocol (CBSP)":https://www.etsi.org/deliver/etsi_ts/148000_148099/148049/15.00.00_60/ts_148049v150000p.pdf
85 2 laforge
* "3GPP TS 22.268 PWS: Public Warning System (PWS) requirements":http://www.etsi.org/deliver/etsi_ts/122200_122299/122268/14.00.00_60/ts_122268v140000p.pdf
86 9 laforge
* "3GPP TS 44.012 GSM: Short Message Service Cell Broadcast (SMSCB) support on the mobile radio interface":https://www.etsi.org/deliver/etsi_ts/144000_144099/144012/15.00.00_60/ts_144012v150000p.pdf
87 2 laforge
88 2 laforge
h3. EU-Alert
89 2 laforge
90 2 laforge
* ETSI/EMTEL TS 102 900
91 2 laforge
92 2 laforge
h3. CMAS
93 2 laforge
94 2 laforge
* ATIS/TIA Standards J-STD-100, 101, 102
95 2 laforge
96 2 laforge
h3. ETWS
Add picture from clipboard (Maximum size: 48.8 MB)