Project

General

Profile

Cell Broadcast » History » Version 19

laforge, 09/13/2019 08:23 PM
add graphviz diagram

1 1 laforge
h1. Cell Broadcast
2 7 fixeria
3 7 fixeria
{{>toc}}
4 1 laforge
5 1 laforge
Normally, all user plane data in GSM/GPRS networks are sent in point-to-point channels from the network to the user. Those are called "dedicated" radio channels whcih exist between the network and one given phone/subscriber at a time.
6 1 laforge
7 1 laforge
Cell Broadcast is an exception to that rule.  It permits user data (so-called SMS-CB data) to be broadcast by the network in a way that can be received by all phones in the coverage area of the given [[BTS]] simultaneously.
8 1 laforge
9 1 laforge
More high-level information can be found at https://en.wikipedia.org/wiki/Cell_Broadcast and the related specification is found at "3GPP TS 23.041 Technical realization of Cell Broadcast Service (CBS)":http://www.3gpp.org/ftp/Specs/html-info/23041.htm
10 1 laforge
11 16 laforge
*NOTE: In 3G/UMTS networks, Cell Broadcast is called [[Service_Area_Broadcast]] and we have a dedicated wiki page for it.*
12 16 laforge
13 19 laforge
{{graphviz_link()
14 19 laforge
digraph G {
15 19 laforge
  BTS0 [label="BTS"];
16 19 laforge
  BTS1 [label="BTS"];
17 19 laforge
  BTS10 [label="BTS"];
18 19 laforge
  BTS11 [label="BTS"];
19 19 laforge
  BSC1 [label="BSC"];
20 19 laforge
21 19 laforge
  User -> CBC [label="proprietaty"];
22 19 laforge
  CBC -> BSC [label="CBSP"];
23 19 laforge
  CBC -> BSC1 [label="CBSP"];
24 19 laforge
  BSC -> BTS0 [label="RSL"];
25 19 laforge
  BSC -> BTS1 [label="RSL"];
26 19 laforge
  BSC1 -> BTS10 [label="RSL"];
27 19 laforge
  BSC1 -> BTS11 [label="RSL"];
28 19 laforge
  BTS0 -> MS [label="CBCH"];
29 19 laforge
}
30 19 laforge
}}
31 19 laforge
32 2 laforge
h2. Use Cases
33 1 laforge
34 2 laforge
Cell Broadcast was used for various different use cases primarily in the 1990ies and early 2000s, including
35 2 laforge
* advertisement of the GPS position of the cell tower you're currently camping on
36 2 laforge
* advertisement of the calling codes of your current "home zone", i.e. a "lower cost short distance" call zone travelling with you as you roam around.
37 2 laforge
38 2 laforge
More recently, SMS-CB is seeing some uptake by various desaster warning systems, such as
39 2 laforge
* CMAS (Commercial Mobile Alert System), later renamed to WEA ("Wireless Emergency Alerts":https://en.wikipedia.org/wiki/Wireless_Emergency_Alerts) in the US.
40 2 laforge
* EU-Alert in the European union
41 2 laforge
* Messer Ishi (Rocket Alert) in Israel
42 2 laforge
* ETWS (Earthquake and Tsunami Warning System) in Japan
43 2 laforge
* KPAS (Korean Public Alert System)
44 2 laforge
45 10 laforge
h2. Osmocom Cell Broadcast support
46 1 laforge
47 18 laforge
* [[OsmoBTS:]] implements
48 18 laforge
** the CBCH channel (both BASIC and EXTENDED) in the SDCCH/4 and SDCCH/8
49 18 laforge
** the "SMS BROADCAST COMMAND" Message in RSL according to Section 8.5.8 of 3GPP TS 08.58
50 18 laforge
** the "CBCH LOAD INDICATION" Message in RSL, which allows the BSC to perform flow control of CBCH messages
51 18 laforge
* [[OsmoNITB:]] and [[OsmoBSC:]] implement a VTY command @bts <0-255> smscb-command <1-4> HEXSTRING@ to send a given hex-formatted cell broadcast message to a specified BTS (this is more a hack for manual testing)
52 1 laforge
** you (obviously) first need to enable a timeslot/channel combination on the BTS that actually includes a CBCH, i.e. ccch+sdcch4+cbch or sdcch8+cbch
53 18 laforge
* [[OsmoBSC:]] implements
54 18 laforge
** the scheduling / allocation of CBCH resources in presence of possibly many SMSCB messages, taking into account their message size, repetition period, duration
55 18 laforge
** the CBSP protocol according to 3GPP TS 48.049 for interaction with a CBC
56 18 laforge
** CBCH flow control based on incoming CBCH LOAD INDICATION via RSL from BTSs
57 18 laforge
** transmission of SMSCB using SMS BROADCAST COMMAND via RSL to BTSs
58 18 laforge
* [[OsmoCBC:]] implements
59 18 laforge
* FIXME
60 19 laforge
61 2 laforge
62 1 laforge
63 1 laforge
64 1 laforge
h3. How to test/use it
65 1 laforge
66 18 laforge
h4. Using recent OsmoBSC and OsmoCBC
67 18 laforge
68 18 laforge
h5. make sure your related BTS is configured to use a channel combination with CBCH
69 18 laforge
70 18 laforge
For using a combined CCCH with SDCCH/4 and CBCH you can use the following example snippet as part of osmo-bsc.cfg:
71 18 laforge
72 18 laforge
<pre>
73 18 laforge
network
74 18 laforge
 bts 0
75 18 laforge
  trx 0
76 18 laforge
   timeslot 0
77 18 laforge
    phys_chan_config CCCH+SDCCH4+CBCH
78 18 laforge
</pre>
79 18 laforge
80 18 laforge
h5. Setting up OsmoCBC
81 18 laforge
82 18 laforge
FIXME.
83 18 laforge
84 18 laforge
h4. Using the "manual hack" via BSC/NITB VTY command
85 18 laforge
86 18 laforge
!osmocom-cbs.png!
87 18 laforge
88 18 laforge
This is sufficient for manual transmission of cell-broadcast messages in a lab environment or in small networks.  The functionality has been developed and "used at the 31st annual CCC congress (31C3) to deliver spoofed _Presidential Level Alert_ messages":https://twitter.com/2b_as/status/549695235207737344/photo/1
89 18 laforge
90 10 laforge
You need to perform two steps:
91 10 laforge
92 18 laforge
h5. make sure your related BTS is configured to use a channel combination with CBCH
93 10 laforge
94 10 laforge
For using a combined CCCH with SDCCH/4 and CBCH you can use the following example snippet as part of osmo-bsc.cfg:
95 10 laforge
96 10 laforge
<pre>
97 10 laforge
network
98 1 laforge
 bts 0
99 10 laforge
  trx 0
100 10 laforge
   timeslot 0
101 10 laforge
    phys_chan_config CCCH+SDCCH4+CBCH
102 10 laforge
</pre>
103 10 laforge
104 18 laforge
h5. telnet to osmo-bsc at port 4242, and enter something like
105 1 laforge
106 1 laforge
<pre>
107 1 laforge
enable
108 1 laforge
bts 0 smscb-command 1 001000320f1141660c344dd3cba09a0c
109 1 laforge
</pre>
110 10 laforge
111 1 laforge
where "1" is the number of blocks required (each 22 bytes need one block)
112 10 laforge
and the hex-dump at the end is the encoded GSM 04.12 message to be broadcast.
113 10 laforge
114 10 laforge
115 3 laforge
116 2 laforge
h2. Message Structure
117 2 laforge
118 2 laforge
* Message has maximum 15 pages
119 2 laforge
* Each page is 82 bytes of data, resulting in 93 characters in GSM 7-bit default alphabet
120 2 laforge
* Messges are broadcast on logical channels (more like an address)
121 2 laforge
* Subscribers can activate/deactivate selective addresses
122 2 laforge
123 2 laforge
h2. Further Reading
124 2 laforge
125 2 laforge
* ITU-T SG2 (Standardization of CB Channels)
126 2 laforge
* ETSI 102 444
127 9 laforge
* "3GPP TS 23.041 GSM: Technical realization of Cell Broadcast Service (CBS)":https://www.etsi.org/deliver/etsi_ts/123000_123099/123041/15.02.00_60/ts_123041v150200p.pdf
128 9 laforge
* "3GPP TS 48.049 GSM: Baste Station Controller - Cell Broadcast Centre (BSC-CBC) interface specification; Cell Broadcast Service Protocol (CBSP)":https://www.etsi.org/deliver/etsi_ts/148000_148099/148049/15.00.00_60/ts_148049v150000p.pdf
129 2 laforge
* "3GPP TS 22.268 PWS: Public Warning System (PWS) requirements":http://www.etsi.org/deliver/etsi_ts/122200_122299/122268/14.00.00_60/ts_122268v140000p.pdf
130 1 laforge
* "3GPP TS 44.012 GSM: Short Message Service Cell Broadcast (SMSCB) support on the mobile radio interface":https://www.etsi.org/deliver/etsi_ts/144000_144099/144012/15.00.00_60/ts_144012v150000p.pdf
131 14 laforge
* "Whitepaper on Displaying Cell Broadcast":https://www.one2many.eu/assets/files/19_displaying-cb-messages.pdf
132 2 laforge
133 2 laforge
h3. EU-Alert
134 2 laforge
135 13 laforge
* "ETSI/EMTEL TS 102 900":https://www.etsi.org/deliver/etsi_ts/102900_102999/102900/01.01.01_60/ts_102900v010101p.pdf
136 2 laforge
137 2 laforge
h3. CMAS
138 2 laforge
139 12 laforge
* "FCC 08-99: First Report and Order":https://www.one2many.eu/assets/files/16_first-report-and-order.pdf
140 12 laforge
* "FCC 08-164: Second Report and Order":https://www.one2many.eu/assets/files/17_second-report-and-order.pdf
141 12 laforge
* "FCC 08-184: Third Report and Order":https://www.one2many.eu/assets/files/18_third-report-and-order.pdf
142 15 laforge
* "ATIS/TIA Standard J-STD-100 (Mobile Device Behavior)":https://global.ihs.com/doc_detail.cfm?&document_name=TIA%20J-STD-100
143 15 laforge
* "ATIS/TIA Standard J-STD-101 (Federal Alert Gateway to CMSP Gateway Interface Spec)":https://global.ihs.com/doc_detail.cfm?&document_name=TIA%20J-STD-101
144 15 laforge
* "ATIS/TIA Standard J-STD-102 (Federal Alert Gateway to CMSP Gateway Interface Test Spec)":https://global.ihs.com/doc_detail.cfm?&document_name=TIA%20J-STD-102
145 14 laforge
* "ATIS 0700006 eWEA via GSM/UMTS Cell Broadcast Service Spec":https://global.ihs.com/doc_detail.cfm?document_name=ATIS%200700006
146 14 laforge
* "ATIS 0700007 Implementation Guidelines and Best Practises for GSM/UMTS Cell Broadcast Service":https://global.ihs.com/doc_detail.cfm?document_name=ATIS%200700007
147 14 laforge
* "ATIS 0700008 Cell Broadcast Entity (CBE)-to-Cell Broadcast Center (CBC) Interface Specification":https://global.ihs.com/doc_detail.cfm?document_name=ATIS%200700008
148 14 laforge
* "ATIS 0700010 Enhanced Wireless Emergency Alert (eWEA) via EPS Public Warning System Specification":https://global.ihs.com/doc_detail.cfm?document_name=ATIS%200700010
149 2 laforge
150 2 laforge
h3. ETWS
151 11 laforge
152 11 laforge
* "3GPP TS 22.168: ETWS Requirements Stage 1":https://www.etsi.org/deliver/etsi_ts/122100_122199/122168/08.03.00_60/ts_122168v080300p.pdf
153 11 laforge
* various modifications to TS 23.038, 23.401, 25.304, 25.331, see http://www.3gpp.org/DynaReport/WiCr--370051.htm
154 17 laforge
155 17 laforge
h2. Cell Broadcast in 3G/UMTS
156 17 laforge
157 17 laforge
See [[Service_Area_Broadcast]]
158 17 laforge
159 17 laforge
h3. Cell Broadcast in 4G/LTE
160 17 laforge
161 17 laforge
h4. SBc interface between CBC and MME
162 17 laforge
163 17 laforge
The interface is based on a ASN.1 based protocol called SBc-AP which is specified in "3GPP TS 29.168":https://www.etsi.org/deliver/etsi_ts/129100_129199/129168/15.01.00_60/ts_129168v150100p.pdf
164 17 laforge
165 17 laforge
The protocol operates over SCTP. Connections are initiated by the CBC to the MME, and the MME listens for SBcAP connections on SCTP port 29168.
Add picture from clipboard (Maximum size: 48.8 MB)