Project

General

Profile

Cell Broadcast » History » Version 23

laforge, 07/21/2021 06:55 AM

1 1 laforge
h1. Cell Broadcast
2 7 fixeria
3
{{>toc}}
4 1 laforge
5
Normally, all user plane data in GSM/GPRS networks are sent in point-to-point channels from the network to the user. Those are called "dedicated" radio channels whcih exist between the network and one given phone/subscriber at a time.
6
7
Cell Broadcast is an exception to that rule.  It permits user data (so-called SMS-CB data) to be broadcast by the network in a way that can be received by all phones in the coverage area of the given [[BTS]] simultaneously.
8
9
More high-level information can be found at https://en.wikipedia.org/wiki/Cell_Broadcast and the related specification is found at "3GPP TS 23.041 Technical realization of Cell Broadcast Service (CBS)":http://www.3gpp.org/ftp/Specs/html-info/23041.htm
10
11 16 laforge
*NOTE: In 3G/UMTS networks, Cell Broadcast is called [[Service_Area_Broadcast]] and we have a dedicated wiki page for it.*
12
13 20 laforge
h2. Cell Broadcast Architecture
14
15
h3. Network Diagram
16
17
This Network diagram shows the relevant elements in the GSM network, including their interconnection.
18
19 19 laforge
{{graphviz_link()
20
digraph G {
21
  BTS0 [label="BTS"];
22
  BTS1 [label="BTS"];
23
  BTS10 [label="BTS"];
24
  BTS11 [label="BTS"];
25
  BSC1 [label="BSC"];
26
27
  User -> CBC [label="proprietaty"];
28
  CBC -> BSC [label="CBSP"];
29
  CBC -> BSC1 [label="CBSP"];
30
  BSC -> BTS0 [label="RSL"];
31
  BSC -> BTS1 [label="RSL"];
32
  BSC1 -> BTS10 [label="RSL"];
33
  BSC1 -> BTS11 [label="RSL"];
34
  BTS0 -> MS [label="CBCH"];
35
}
36
}}
37 20 laforge
38
h3. Ladder Diagram
39
40
This ladder diagram shows the propagation / flow of messages across the Cell Broadcast enabled network.
41
42
!osmodevcon2019-cell_broadcast__2.png!
43 19 laforge
44 2 laforge
h2. Use Cases
45 1 laforge
46 2 laforge
Cell Broadcast was used for various different use cases primarily in the 1990ies and early 2000s, including
47
* advertisement of the GPS position of the cell tower you're currently camping on
48
* advertisement of the calling codes of your current "home zone", i.e. a "lower cost short distance" call zone travelling with you as you roam around.
49
50
More recently, SMS-CB is seeing some uptake by various desaster warning systems, such as
51
* CMAS (Commercial Mobile Alert System), later renamed to WEA ("Wireless Emergency Alerts":https://en.wikipedia.org/wiki/Wireless_Emergency_Alerts) in the US.
52
* EU-Alert in the European union
53
* Messer Ishi (Rocket Alert) in Israel
54
* ETWS (Earthquake and Tsunami Warning System) in Japan
55
* KPAS (Korean Public Alert System)
56
57 10 laforge
h2. Osmocom Cell Broadcast support
58 1 laforge
59 18 laforge
* [[OsmoBTS:]] implements
60
** the CBCH channel (both BASIC and EXTENDED) in the SDCCH/4 and SDCCH/8
61
** the "SMS BROADCAST COMMAND" Message in RSL according to Section 8.5.8 of 3GPP TS 08.58
62
** the "CBCH LOAD INDICATION" Message in RSL, which allows the BSC to perform flow control of CBCH messages
63
* [[OsmoNITB:]] and [[OsmoBSC:]] implement a VTY command @bts <0-255> smscb-command <1-4> HEXSTRING@ to send a given hex-formatted cell broadcast message to a specified BTS (this is more a hack for manual testing)
64 1 laforge
** you (obviously) first need to enable a timeslot/channel combination on the BTS that actually includes a CBCH, i.e. ccch+sdcch4+cbch or sdcch8+cbch
65 18 laforge
* [[OsmoBSC:]] implements
66
** the scheduling / allocation of CBCH resources in presence of possibly many SMSCB messages, taking into account their message size, repetition period, duration
67
** the CBSP protocol according to 3GPP TS 48.049 for interaction with a CBC
68
** CBCH flow control based on incoming CBCH LOAD INDICATION via RSL from BTSs
69
** transmission of SMSCB using SMS BROADCAST COMMAND via RSL to BTSs
70
* [[OsmoCBC:]] implements
71
* FIXME
72 19 laforge
73 1 laforge
h3. How to test/use it
74
75 18 laforge
h4. Using recent OsmoBSC and OsmoCBC
76 1 laforge
77 18 laforge
h5. make sure your related BTS is configured to use a channel combination with CBCH
78 1 laforge
79 21 laforge
You have the choice of adding CBCH either on a a CCCH with SDCCH/4 or on a SDCCH/8.  You will loose one of the SDCCHs in terms of capacity.
80 18 laforge
81 21 laforge
Example: For using a combined CCCH with SDCCH/4 and CBCH you can use the following example snippet as part of osmo-bsc.cfg:
82
83 18 laforge
<pre>
84
network
85
 bts 0
86
  trx 0
87
   timeslot 0
88
    phys_chan_config CCCH+SDCCH4+CBCH
89 1 laforge
</pre>
90
91
h5. Setting up OsmoCBC
92
93 21 laforge
Please see [[osmo-cbc:Quick_SMSCB_HOWTO]] and the "osmo-cbc user manual":https://ftp.osmocom.org/docs/latest/osmocbc-usermanual.pdf for further information.
94 1 laforge
95 21 laforge
h4. DEPRECATED: Using the "manual hack" via BSC/NITB VTY command
96 18 laforge
97 21 laforge
Before [[osmo-cbc:]] was implemented, we introduced a "manual hack" that allows the user of the BSC to send relatively raw RSL commands towards a BTS.
98
99
*Please don't use this method anymore, and instead use the osmo-cbc based method described above*
100
101 18 laforge
!osmocom-cbs.png!
102
103
This is sufficient for manual transmission of cell-broadcast messages in a lab environment or in small networks.  The functionality has been developed and "used at the 31st annual CCC congress (31C3) to deliver spoofed _Presidential Level Alert_ messages":https://twitter.com/2b_as/status/549695235207737344/photo/1
104
105 10 laforge
You need to perform two steps:
106
107 18 laforge
h5. make sure your related BTS is configured to use a channel combination with CBCH
108 10 laforge
109
For using a combined CCCH with SDCCH/4 and CBCH you can use the following example snippet as part of osmo-bsc.cfg:
110
111
<pre>
112
network
113 1 laforge
 bts 0
114 10 laforge
  trx 0
115
   timeslot 0
116
    phys_chan_config CCCH+SDCCH4+CBCH
117
</pre>
118
119 1 laforge
h5. telnet to osmo-bsc at port 4242, and enter something like
120
121
<pre>
122
enable
123 10 laforge
bts 0 smscb-command 1 001000320f1141660c344dd3cba09a0c
124 1 laforge
</pre>
125 10 laforge
126
where "1" is the number of blocks required (each 22 bytes need one block)
127
and the hex-dump at the end is the encoded GSM 04.12 message to be broadcast.
128 3 laforge
129 2 laforge
h2. Message Structure
130
131
* Message has maximum 15 pages
132
* Each page is 82 bytes of data, resulting in 93 characters in GSM 7-bit default alphabet
133
* Messges are broadcast on logical channels (more like an address)
134
* Subscribers can activate/deactivate selective addresses
135
136
h2. Further Reading
137
138
* ITU-T SG2 (Standardization of CB Channels)
139
* ETSI 102 444
140 9 laforge
* "3GPP TS 23.041 GSM: Technical realization of Cell Broadcast Service (CBS)":https://www.etsi.org/deliver/etsi_ts/123000_123099/123041/15.02.00_60/ts_123041v150200p.pdf
141
* "3GPP TS 48.049 GSM: Baste Station Controller - Cell Broadcast Centre (BSC-CBC) interface specification; Cell Broadcast Service Protocol (CBSP)":https://www.etsi.org/deliver/etsi_ts/148000_148099/148049/15.00.00_60/ts_148049v150000p.pdf
142 2 laforge
* "3GPP TS 22.268 PWS: Public Warning System (PWS) requirements":http://www.etsi.org/deliver/etsi_ts/122200_122299/122268/14.00.00_60/ts_122268v140000p.pdf
143 1 laforge
* "3GPP TS 44.012 GSM: Short Message Service Cell Broadcast (SMSCB) support on the mobile radio interface":https://www.etsi.org/deliver/etsi_ts/144000_144099/144012/15.00.00_60/ts_144012v150000p.pdf
144 14 laforge
* "Whitepaper on Displaying Cell Broadcast":https://www.one2many.eu/assets/files/19_displaying-cb-messages.pdf
145 2 laforge
146
h3. EU-Alert
147
148 13 laforge
* "ETSI/EMTEL TS 102 900":https://www.etsi.org/deliver/etsi_ts/102900_102999/102900/01.01.01_60/ts_102900v010101p.pdf
149 2 laforge
150
h3. CMAS
151
152 12 laforge
* "FCC 08-99: First Report and Order":https://www.one2many.eu/assets/files/16_first-report-and-order.pdf
153
* "FCC 08-164: Second Report and Order":https://www.one2many.eu/assets/files/17_second-report-and-order.pdf
154
* "FCC 08-184: Third Report and Order":https://www.one2many.eu/assets/files/18_third-report-and-order.pdf
155 15 laforge
* "ATIS/TIA Standard J-STD-100 (Mobile Device Behavior)":https://global.ihs.com/doc_detail.cfm?&document_name=TIA%20J-STD-100
156
* "ATIS/TIA Standard J-STD-101 (Federal Alert Gateway to CMSP Gateway Interface Spec)":https://global.ihs.com/doc_detail.cfm?&document_name=TIA%20J-STD-101
157
* "ATIS/TIA Standard J-STD-102 (Federal Alert Gateway to CMSP Gateway Interface Test Spec)":https://global.ihs.com/doc_detail.cfm?&document_name=TIA%20J-STD-102
158 14 laforge
* "ATIS 0700006 eWEA via GSM/UMTS Cell Broadcast Service Spec":https://global.ihs.com/doc_detail.cfm?document_name=ATIS%200700006
159
* "ATIS 0700007 Implementation Guidelines and Best Practises for GSM/UMTS Cell Broadcast Service":https://global.ihs.com/doc_detail.cfm?document_name=ATIS%200700007
160
* "ATIS 0700008 Cell Broadcast Entity (CBE)-to-Cell Broadcast Center (CBC) Interface Specification":https://global.ihs.com/doc_detail.cfm?document_name=ATIS%200700008
161
* "ATIS 0700010 Enhanced Wireless Emergency Alert (eWEA) via EPS Public Warning System Specification":https://global.ihs.com/doc_detail.cfm?document_name=ATIS%200700010
162 2 laforge
163
h3. ETWS
164 11 laforge
165
* "3GPP TS 22.168: ETWS Requirements Stage 1":https://www.etsi.org/deliver/etsi_ts/122100_122199/122168/08.03.00_60/ts_122168v080300p.pdf
166
* various modifications to TS 23.038, 23.401, 25.304, 25.331, see http://www.3gpp.org/DynaReport/WiCr--370051.htm
167 17 laforge
168
h2. Cell Broadcast in 3G/UMTS
169
170
See [[Service_Area_Broadcast]]
171
172 23 laforge
h2. Cell Broadcast in 4G/LTE
173 17 laforge
174 22 laforge
4G/LTE doesn't have a general-purpose Cell Broadcast mechanism (for any kind of broadcasts) anymore.  Instead, it supports only broadcasting of emergency warning messages and calls this "PWS" (Public Warning System)
175
176
On the radio interface, there is no special downlink channel to send those PWS messages.  Instead, they are transmitted as SIB (System Information Block) alongside all the other SIB messages containing cell identity, etc. on the BCCH.
177
178 23 laforge
h3. SBc interface between CBC and MME
179 17 laforge
180
The interface is based on a ASN.1 based protocol called SBc-AP which is specified in "3GPP TS 29.168":https://www.etsi.org/deliver/etsi_ts/129100_129199/129168/15.01.00_60/ts_129168v150100p.pdf
181
182
The protocol operates over SCTP. Connections are initiated by the CBC to the MME, and the MME listens for SBcAP connections on SCTP port 29168.
183 22 laforge
184 23 laforge
h3. S1 interface between MME and eNodeB
185 22 laforge
186
From the MME to the eNodeB, the normal S1 interface is used to transport PWS messages.  The protocol is the normal S1AP, which is used for all other signaling between MME and eNodeB, too.
187
188
The related messsages on S1 are:
189
* WRITE-REPLACE-WARNING-REQUEST (to create or update a PWS message that is to be broadcast)
190
* KILL-REQUEST (to stop broadcasting a PWS message)
191
192
Our sister project open5gs implements encoding those messages in "src/mme/s1ap-build.c":https://github.com/open5gs/open5gs/blob/main/src/mme/s1ap-build.c
Add picture from clipboard (Maximum size: 48.8 MB)