Cell Broadcast » History » Version 9
- Table of contents
- Cell Broadcast
Normally, all user plane data in GSM/GPRS networks are sent in point-to-point channels from the network to the user. Those are called "dedicated" radio channels whcih exist between the network and one given phone/subscriber at a time.
Cell Broadcast is an exception to that rule. It permits user data (so-called SMS-CB data) to be broadcast by the network in a way that can be received by all phones in the coverage area of the given BTS simultaneously.
More high-level information can be found at https://en.wikipedia.org/wiki/Cell_Broadcast and the related specification is found at 3GPP TS 23.041 Technical realization of Cell Broadcast Service
Use Cases¶Cell Broadcast was used for various different use cases primarily in the 1990ies and early 2000s, including
- advertisement of the GPS position of the cell tower you're currently camping on
- advertisement of the calling codes of your current "home zone", i.e. a "lower cost short distance" call zone travelling with you as you roam around.
- CMAS (Commercial Mobile Alert System), later renamed to WEA (Wireless Emergency Alerts) in the US.
- EU-Alert in the European union
- Messer Ishi (Rocket Alert) in Israel
- ETWS (Earthquake and Tsunami Warning System) in Japan
- KPAS (Korean Public Alert System)
Osmocom Cell Broadcast support¶
- OsmoBTS implements the "SMS BROADCAST COMMAND" Message in RSL according to Section 8.5.8 of 3GPP TS 08.58 but not all hardware targets support this yet, see #1617. osmo-bts-sysmo and osmo-bts-octphy are fine.
- OsmoNITB and OsmoBSC implement a VTY command
bts <0-255> smscb-command <1-4> HEXSTRINGto send a given hex-formatted cell broadcast message to a specified BTS
- you (obviously) first need to enable a timeslot/channel combination on the BTS that actually includes a CBCH, i.e. ccch+sdcch4+cbch or sdcch8+cbch
This is sufficient for manual transmission of cell-broadcast messages in a lab environment or in small networks. The functionality has been developed and used at the 31st annual CCC congress (31C3) to deliver spoofed Presidential Level Alert messages
What's missing (for production operation in larger networks)¶
- mechanism to broadcast one (set of) cell broadcast messages from the BSC to multiple/all BTSs, rather than one BTS individually
- BTS reporting of current CBCH load
- BSC scheduler scheduling multiple alternating sets of CBCH messages based on the current CBCH load reported by BTS
- external interface from BSC to a Cell Broadcast Center (CBC), e.g. according to 3GPP TS 48.049
- an Osmocom implementation of the Cell Broadcast Center (OsmoCBC) which can manage and dsitribute messages to multiple BSCs and which has an external interface by which cell-broadcast can be entered into the network
- Message has maximum 15 pages
- Each page is 82 bytes of data, resulting in 93 characters in GSM 7-bit default alphabet
- Messges are broadcast on logical channels (more like an address)
- Subscribers can activate/deactivate selective addresses
- ITU-T SG2 (Standardization of CB Channels)
- 3GPP TS 23.041 Cell Broadcast
- ETSI 102 444
- 3GPP TS 23.041 GSM: Technical realization of Cell Broadcast Service
- 3GPP TS 48.049 GSM: Baste Station Controller - Cell Broadcast Centre (BSC-CBC) interface specification; Cell Broadcast Service Protocol
- 3GPP TS 22.268 PWS: Public Warning System (PWS) requirements
- 3GPP TS 44.012 GSM: Short Message Service Cell Broadcast (SMSCB) support on the mobile radio interface
- ETSI/EMTEL TS 102 900
- ATIS/TIA Standards J-STD-100, 101, 102