Cell Broadcast¶

• Table of contents
• Cell Broadcast
  • Use Cases
  • Osmocom Cell Broadcast support
    • How to test/use it
      • make sure your related BTS is configured to use a channel combination with CBCH
      • telnet to osmo-bsc at port 4242, and enter something like
    • What's missing (for production operation in larger networks)
  • Message Structure
  • Further Reading
    • EU-Alert
    • CMAS
    • ETWS

Normally, all user plane data in GSM/GPRS networks are sent in point-to-point channels from the network to the user. Those are called "dedicated" radio channels whcih exist between the network and one given phone/subscriber at a time.

Cell Broadcast is an exception to that rule. It permits user data (so-called SMS-CB data) to be broadcast by the network in a way that can be received by all phones in the coverage area of the given BTS simultaneously.

More high-level information can be found at https://en.wikipedia.org/wiki/Cell_Broadcast and the related specification is found at 3GPP TS 23.041 Technical realization of Cell Broadcast Service

NOTE: In 3G/UMTS networks, Cell Broadcast is called Service_Area_Broadcast and we have a dedicated wiki page for it.

Use Cases¶

Cell Broadcast was used for various different use cases primarily in the 1990ies and early 2000s, including

• advertisement of the GPS position of the cell tower you're currently camping on
• advertisement of the calling codes of your current "home zone", i.e. a "lower cost short distance" call zone travelling with you as you roam around.

More recently, SMS-CB is seeing some uptake by various desaster warning systems, such as

• CMAS (Commercial Mobile Alert System), later renamed to WEA (Wireless Emergency Alerts) in the US.
• EU-Alert in the European union
• Messer Ishi (Rocket Alert) in Israel
• ETWS (Earthquake and Tsunami Warning System) in Japan
• KPAS (Korean Public Alert System)

Osmocom Cell Broadcast support¶

• OsmoBTS implements the "SMS BROADCAST COMMAND" Message in RSL according to Section 8.5.8 of 3GPP TS 08.58 but not all hardware targets support this yet, see #1617. osmo-bts-sysmo and osmo-bts-octphy are fine.
• OsmoNITB and OsmoBSC implement a VTY command bts <0-255> smscb-command <1-4> HEXSTRING to send a given hex-formatted cell broadcast message to a specified BTS
  • you (obviously) first need to enable a timeslot/channel combination on the BTS that actually includes a CBCH, i.e. ccch+sdcch4+cbch or sdcch8+cbch

This is sufficient for manual transmission of cell-broadcast messages in a lab environment or in small networks. The functionality has been developed and used at the 31st annual CCC congress (31C3) to deliver spoofed Presidential Level Alert messages

How to test/use it¶

You need to perform two steps:

make sure your related BTS is configured to use a channel combination with CBCH¶

For using a combined CCCH with SDCCH/4 and CBCH you can use the following example snippet as part of osmo-bsc.cfg:

network
 bts 0
  trx 0
   timeslot 0
    phys_chan_config CCCH+SDCCH4+CBCH

telnet to osmo-bsc at port 4242, and enter something like¶

enable
bts 0 smscb-command 1 001000320f1141660c344dd3cba09a0c

where "1" is the number of blocks required (each 22 bytes need one block)
and the hex-dump at the end is the encoded GSM 04.12 message to be broadcast.

What's missing (for production operation in larger networks)¶

• mechanism to broadcast one (set of) cell broadcast messages from the BSC to multiple/all BTSs, rather than one BTS individually
• BTS reporting of current CBCH load
• BSC scheduler scheduling multiple alternating sets of CBCH messages based on the current CBCH load reported by BTS
• external interface from BSC to a Cell Broadcast Center (CBC), e.g. according to 3GPP TS 48.049 (CBSP)
• an Osmocom implementation of the Cell Broadcast Center (OsmoCBC) which can manage and dsitribute messages to multiple BSCs and which has an external interface by which cell-broadcast can be entered into the network

Message Structure¶

• Message has maximum 15 pages
• Each page is 82 bytes of data, resulting in 93 characters in GSM 7-bit default alphabet
• Messges are broadcast on logical channels (more like an address)
• Subscribers can activate/deactivate selective addresses

Further Reading¶

• ITU-T SG2 (Standardization of CB Channels)
• ETSI 102 444
• 3GPP TS 23.041 GSM: Technical realization of Cell Broadcast Service
• 3GPP TS 48.049 GSM: Baste Station Controller - Cell Broadcast Centre (BSC-CBC) interface specification; Cell Broadcast Service Protocol
• 3GPP TS 22.268 PWS: Public Warning System (PWS) requirements
• 3GPP TS 44.012 GSM: Short Message Service Cell Broadcast (SMSCB) support on the mobile radio interface
• Whitepaper on Displaying Cell Broadcast

EU-Alert¶

• ETSI/EMTEL TS 102 900

CMAS¶

• FCC 08-99: First Report and Order
• FCC 08-164: Second Report and Order
• FCC 08-184: Third Report and Order
• ATIS/TIA Standard J-STD-100
• ATIS/TIA Standard J-STD-101
• ATIS/TIA Standard J-STD-102
• ATIS 0700006 eWEA via GSM/UMTS Cell Broadcast Service Spec
• ATIS 0700007 Implementation Guidelines and Best Practises for GSM/UMTS Cell Broadcast Service
• ATIS 0700008 Cell Broadcast Entity (CBE)-to-Cell Broadcast Center (CBC) Interface Specification
• ATIS 0700010 Enhanced Wireless Emergency Alert (eWEA) via EPS Public Warning System Specification

ETWS¶

• 3GPP TS 22.168: ETWS Requirements Stage 1
• various modifications to TS 23.038, 23.401, 25.304, 25.331, see http://www.3gpp.org/DynaReport/WiCr--370051.htm