Project

General

Profile

Cell Broadcast » History » Version 17

laforge, 03/01/2019 05:42 PM
mention SBc/LTE

1 1 laforge
h1. Cell Broadcast
2 7 fixeria
3 7 fixeria
{{>toc}}
4 1 laforge
5 1 laforge
Normally, all user plane data in GSM/GPRS networks are sent in point-to-point channels from the network to the user. Those are called "dedicated" radio channels whcih exist between the network and one given phone/subscriber at a time.
6 1 laforge
7 1 laforge
Cell Broadcast is an exception to that rule.  It permits user data (so-called SMS-CB data) to be broadcast by the network in a way that can be received by all phones in the coverage area of the given [[BTS]] simultaneously.
8 1 laforge
9 1 laforge
More high-level information can be found at https://en.wikipedia.org/wiki/Cell_Broadcast and the related specification is found at "3GPP TS 23.041 Technical realization of Cell Broadcast Service (CBS)":http://www.3gpp.org/ftp/Specs/html-info/23041.htm
10 1 laforge
11 16 laforge
*NOTE: In 3G/UMTS networks, Cell Broadcast is called [[Service_Area_Broadcast]] and we have a dedicated wiki page for it.*
12 16 laforge
13 2 laforge
h2. Use Cases
14 1 laforge
15 2 laforge
Cell Broadcast was used for various different use cases primarily in the 1990ies and early 2000s, including
16 2 laforge
* advertisement of the GPS position of the cell tower you're currently camping on
17 2 laforge
* advertisement of the calling codes of your current "home zone", i.e. a "lower cost short distance" call zone travelling with you as you roam around.
18 2 laforge
19 2 laforge
More recently, SMS-CB is seeing some uptake by various desaster warning systems, such as
20 2 laforge
* CMAS (Commercial Mobile Alert System), later renamed to WEA ("Wireless Emergency Alerts":https://en.wikipedia.org/wiki/Wireless_Emergency_Alerts) in the US.
21 2 laforge
* EU-Alert in the European union
22 2 laforge
* Messer Ishi (Rocket Alert) in Israel
23 2 laforge
* ETWS (Earthquake and Tsunami Warning System) in Japan
24 2 laforge
* KPAS (Korean Public Alert System)
25 2 laforge
26 10 laforge
h2. Osmocom Cell Broadcast support
27 1 laforge
28 6 laforge
* [[OsmoBTS:]] implements the "SMS BROADCAST COMMAND" Message in RSL according to Section 8.5.8 of 3GPP TS 08.58 *but not all hardware targets support this yet, see #1617. osmo-bts-sysmo and osmo-bts-octphy are fine.*
29 1 laforge
* [[OsmoNITB:]] and [[OsmoBSC:]] implement a VTY command @bts <0-255> smscb-command <1-4> HEXSTRING@ to send a given hex-formatted cell broadcast message to a specified BTS
30 8 laforge
** you (obviously) first need to enable a timeslot/channel combination on the BTS that actually includes a CBCH, i.e. ccch+sdcch4+cbch or sdcch8+cbch
31 1 laforge
32 4 laforge
!osmocom-cbs.png!
33 4 laforge
34 2 laforge
This is sufficient for manual transmission of cell-broadcast messages in a lab environment or in small networks.  The functionality has been developed and "used at the 31st annual CCC congress (31C3) to deliver spoofed _Presidential Level Alert_ messages":https://twitter.com/2b_as/status/549695235207737344/photo/1
35 1 laforge
36 10 laforge
h3. How to test/use it
37 10 laforge
38 10 laforge
You need to perform two steps:
39 10 laforge
40 10 laforge
h4. make sure your related BTS is configured to use a channel combination with CBCH
41 10 laforge
42 10 laforge
For using a combined CCCH with SDCCH/4 and CBCH you can use the following example snippet as part of osmo-bsc.cfg:
43 10 laforge
44 10 laforge
<pre>
45 10 laforge
network
46 10 laforge
 bts 0
47 10 laforge
  trx 0
48 10 laforge
   timeslot 0
49 10 laforge
    phys_chan_config CCCH+SDCCH4+CBCH
50 10 laforge
</pre>
51 10 laforge
52 10 laforge
h4. telnet to osmo-bsc at port 4242, and enter something like
53 10 laforge
54 10 laforge
<pre>
55 10 laforge
enable
56 10 laforge
bts 0 smscb-command 1 001000320f1141660c344dd3cba09a0c
57 10 laforge
</pre>
58 10 laforge
59 10 laforge
where "1" is the number of blocks required (each 22 bytes need one block)
60 10 laforge
and the hex-dump at the end is the encoded GSM 04.12 message to be broadcast.
61 10 laforge
62 1 laforge
h3. What's missing (for production operation in larger networks)
63 1 laforge
64 1 laforge
* mechanism to broadcast one (set of) cell broadcast messages from the BSC to multiple/all BTSs, rather than one BTS individually
65 1 laforge
* BTS reporting of current CBCH load
66 1 laforge
* BSC scheduler scheduling multiple alternating sets of CBCH messages based on the current CBCH load reported by BTS
67 10 laforge
* external interface from BSC to a Cell Broadcast Center (CBC), e.g. according to 3GPP TS 48.049 (CBSP)
68 1 laforge
* an Osmocom implementation of the Cell Broadcast Center (OsmoCBC) which can manage and dsitribute messages to multiple BSCs and which has an external interface by which cell-broadcast can be entered into the network
69 10 laforge
70 10 laforge
71 10 laforge
72 3 laforge
73 2 laforge
h2. Message Structure
74 2 laforge
75 2 laforge
* Message has maximum 15 pages
76 2 laforge
* Each page is 82 bytes of data, resulting in 93 characters in GSM 7-bit default alphabet
77 2 laforge
* Messges are broadcast on logical channels (more like an address)
78 2 laforge
* Subscribers can activate/deactivate selective addresses
79 2 laforge
80 2 laforge
h2. Further Reading
81 2 laforge
82 2 laforge
* ITU-T SG2 (Standardization of CB Channels)
83 2 laforge
* ETSI 102 444
84 9 laforge
* "3GPP TS 23.041 GSM: Technical realization of Cell Broadcast Service (CBS)":https://www.etsi.org/deliver/etsi_ts/123000_123099/123041/15.02.00_60/ts_123041v150200p.pdf
85 9 laforge
* "3GPP TS 48.049 GSM: Baste Station Controller - Cell Broadcast Centre (BSC-CBC) interface specification; Cell Broadcast Service Protocol (CBSP)":https://www.etsi.org/deliver/etsi_ts/148000_148099/148049/15.00.00_60/ts_148049v150000p.pdf
86 2 laforge
* "3GPP TS 22.268 PWS: Public Warning System (PWS) requirements":http://www.etsi.org/deliver/etsi_ts/122200_122299/122268/14.00.00_60/ts_122268v140000p.pdf
87 1 laforge
* "3GPP TS 44.012 GSM: Short Message Service Cell Broadcast (SMSCB) support on the mobile radio interface":https://www.etsi.org/deliver/etsi_ts/144000_144099/144012/15.00.00_60/ts_144012v150000p.pdf
88 14 laforge
* "Whitepaper on Displaying Cell Broadcast":https://www.one2many.eu/assets/files/19_displaying-cb-messages.pdf
89 2 laforge
90 2 laforge
h3. EU-Alert
91 2 laforge
92 13 laforge
* "ETSI/EMTEL TS 102 900":https://www.etsi.org/deliver/etsi_ts/102900_102999/102900/01.01.01_60/ts_102900v010101p.pdf
93 2 laforge
94 2 laforge
h3. CMAS
95 2 laforge
96 12 laforge
* "FCC 08-99: First Report and Order":https://www.one2many.eu/assets/files/16_first-report-and-order.pdf
97 12 laforge
* "FCC 08-164: Second Report and Order":https://www.one2many.eu/assets/files/17_second-report-and-order.pdf
98 12 laforge
* "FCC 08-184: Third Report and Order":https://www.one2many.eu/assets/files/18_third-report-and-order.pdf
99 15 laforge
* "ATIS/TIA Standard J-STD-100 (Mobile Device Behavior)":https://global.ihs.com/doc_detail.cfm?&document_name=TIA%20J-STD-100
100 15 laforge
* "ATIS/TIA Standard J-STD-101 (Federal Alert Gateway to CMSP Gateway Interface Spec)":https://global.ihs.com/doc_detail.cfm?&document_name=TIA%20J-STD-101
101 15 laforge
* "ATIS/TIA Standard J-STD-102 (Federal Alert Gateway to CMSP Gateway Interface Test Spec)":https://global.ihs.com/doc_detail.cfm?&document_name=TIA%20J-STD-102
102 14 laforge
* "ATIS 0700006 eWEA via GSM/UMTS Cell Broadcast Service Spec":https://global.ihs.com/doc_detail.cfm?document_name=ATIS%200700006
103 14 laforge
* "ATIS 0700007 Implementation Guidelines and Best Practises for GSM/UMTS Cell Broadcast Service":https://global.ihs.com/doc_detail.cfm?document_name=ATIS%200700007
104 14 laforge
* "ATIS 0700008 Cell Broadcast Entity (CBE)-to-Cell Broadcast Center (CBC) Interface Specification":https://global.ihs.com/doc_detail.cfm?document_name=ATIS%200700008
105 14 laforge
* "ATIS 0700010 Enhanced Wireless Emergency Alert (eWEA) via EPS Public Warning System Specification":https://global.ihs.com/doc_detail.cfm?document_name=ATIS%200700010
106 2 laforge
107 2 laforge
h3. ETWS
108 11 laforge
109 11 laforge
* "3GPP TS 22.168: ETWS Requirements Stage 1":https://www.etsi.org/deliver/etsi_ts/122100_122199/122168/08.03.00_60/ts_122168v080300p.pdf
110 11 laforge
* various modifications to TS 23.038, 23.401, 25.304, 25.331, see http://www.3gpp.org/DynaReport/WiCr--370051.htm
111 17 laforge
112 17 laforge
h2. Cell Broadcast in 3G/UMTS
113 17 laforge
114 17 laforge
See [[Service_Area_Broadcast]]
115 17 laforge
116 17 laforge
h3. Cell Broadcast in 4G/LTE
117 17 laforge
118 17 laforge
h4. SBc interface between CBC and MME
119 17 laforge
120 17 laforge
The interface is based on a ASN.1 based protocol called SBc-AP which is specified in "3GPP TS 29.168":https://www.etsi.org/deliver/etsi_ts/129100_129199/129168/15.01.00_60/ts_129168v150100p.pdf
121 17 laforge
122 17 laforge
The protocol operates over SCTP. Connections are initiated by the CBC to the MME, and the MME listens for SBcAP connections on SCTP port 29168.
Add picture from clipboard (Maximum size: 48.8 MB)