RRLP » History » Version 5
admin, 02/19/2016 10:52 PM
add notice about SUPL and the gpsworld article
1 | 2 | admin | [[PageOutline]] |
---|---|---|---|
2 | 1 | admin | = RRLP = |
3 | |||
4 | 4 | admin | RRLP is the ''Radio Resource LCS (Location Service) Protocol'' as specified first in GSM TS 04.31 |
5 | 1 | admin | |
6 | It allows the GSM network operator to obtain very precise location information about a mobile phone, |
||
7 | much more precise than is required for normal operation of the cellular network. |
||
8 | |||
9 | The use of RRLP has been specified for emergency calls. However, nothing in its specification |
||
10 | restricts its use to this application. |
||
11 | |||
12 | In all known phones, RRLP operation is completely invisible to the user of the phone. |
||
13 | |||
14 | As GSM networks do not need to authenticate themselves, anyone can run a ''false BTS'' attack and |
||
15 | successively obtain precise position information on a given mobile phone. |
||
16 | |||
17 | 2 | admin | The popular Free Software implementations of the GSM network [http://openbsc.osmocom.org/ OpenBSC] |
18 | and [http://openbts.sourceforge.net/ OpenBTS] both support RRLP inquiries to mobile phones |
||
19 | |||
20 | 5 | admin | Contrary to the user-plane based [wiki:SUPL], RRLP works entirely in the signaling plane of the network. As such, the |
21 | RRLP protocol level is not accessible to user applications on a phone. For a discussion of RRLP, SUPL |
||
22 | and the various different location measurement methods for mobile phones, please check this excellent |
||
23 | article: http://www.gpsworld.com/gps/wireless-choices-lbs-control-plane-and-user-plane-architectures-1576 |
||
24 | |||
25 | 1 | admin | == RRLP Modes == |
26 | |||
27 | RRLP operates in different ''modes''. |
||
28 | |||
29 | 5 | admin | === MS-based GPS === |
30 | 1 | admin | |
31 | In this method, the phone operates a stand-alone GPS receiver like it can be found in personal navigation devices. |
||
32 | |||
33 | The GPS receiver will do the regular GPS receive process, i.e. |
||
34 | * iterate over the list of 64 possible scrambling codes and acquire the C/A signal |
||
35 | * decode the actual data signal modulated onto the C/A carrier |
||
36 | * measure the timing difference of arrival (TDOA) of the various satellite signals |
||
37 | * compute a location estimate (GPS coordinates) based on the measurements |
||
38 | |||
39 | This complete GPS position fix is then communicated to the SMLC inside the GSM core network. |
||
40 | |||
41 | 5 | admin | ==== Assistance Data ==== |
42 | 1 | admin | |
43 | Most RRLP capable phones will request GPS assistance data from the network. |
||
44 | |||
45 | The operation of the GPS receiver is similar to the regular MS-based GPS aporach described above, |
||
46 | however the GPS receiver is now an A-GPS receiver that already knows the almanac/ephemeris data and |
||
47 | 2 | admin | can thus much more quickly acquire the signal. |
48 | |||
49 | [http://git.osmocom.org/gitweb?p=osmocom-lcs.git;a=summary osmocom-lcs.git] contains a program |
||
50 | 1 | admin | that obtains the ephemeris data from an u-blox GPS receiver and structures/encodes it in the format |
51 | 2 | admin | needed by RRLP |
52 | 1 | admin | |
53 | 5 | admin | === MS-assisted GPS === |
54 | 1 | admin | |
55 | In MS-assisted GPS, the MS does not compute the actual location. Instead, the location/position |
||
56 | of the phone is computed in the SMLC (part of the GSM core network). |
||
57 | |||
58 | 3 | admin | The SMLC provides detailed information about the current GPS signal to the phone, such as: |
59 | * which satellites are currently in the visible part of the hemisphere (and implicitly their scrambling code) |
||
60 | * the expected ''doppler shift'' observed at the MS location, caused by satellite movement relative to MS |
||
61 | * the expected ''code phase'', i.e. the difference between a specified GSM bit and the GPS signal chip / bit |
||
62 | * the azimuth and elevation of the satellite |
||
63 | |||
64 | Based on this information, the phone does not have to do a full search/acquisition like a stand-alone GPS receiver. |
||
65 | |||
66 | Instead, it can do a very narrow search for each satellite in question, as it already knows |
||
67 | * at which doppler shift / range to expect the signal |
||
68 | * which pseudo-random scrambling sequence to use |
||
69 | 1 | admin | * a very narrow position within the scrambling sequence |
70 | 3 | admin | |
71 | This significantly reduces the need for cross-correlation inside the phone. |
||
72 | 1 | admin | |
73 | 5 | admin | === E-OTD === |
74 | 1 | admin | |
75 | FIXME |