Cell Broadcast » History » Version 21
laforge, 02/06/2021 12:02 PM
1 | 1 | laforge | h1. Cell Broadcast |
---|---|---|---|
2 | 7 | fixeria | |
3 | {{>toc}} |
||
4 | 1 | laforge | |
5 | Normally, all user plane data in GSM/GPRS networks are sent in point-to-point channels from the network to the user. Those are called "dedicated" radio channels whcih exist between the network and one given phone/subscriber at a time. |
||
6 | |||
7 | Cell Broadcast is an exception to that rule. It permits user data (so-called SMS-CB data) to be broadcast by the network in a way that can be received by all phones in the coverage area of the given [[BTS]] simultaneously. |
||
8 | |||
9 | More high-level information can be found at https://en.wikipedia.org/wiki/Cell_Broadcast and the related specification is found at "3GPP TS 23.041 Technical realization of Cell Broadcast Service (CBS)":http://www.3gpp.org/ftp/Specs/html-info/23041.htm |
||
10 | |||
11 | 16 | laforge | *NOTE: In 3G/UMTS networks, Cell Broadcast is called [[Service_Area_Broadcast]] and we have a dedicated wiki page for it.* |
12 | |||
13 | 20 | laforge | h2. Cell Broadcast Architecture |
14 | |||
15 | h3. Network Diagram |
||
16 | |||
17 | This Network diagram shows the relevant elements in the GSM network, including their interconnection. |
||
18 | |||
19 | 19 | laforge | {{graphviz_link() |
20 | digraph G { |
||
21 | BTS0 [label="BTS"]; |
||
22 | BTS1 [label="BTS"]; |
||
23 | BTS10 [label="BTS"]; |
||
24 | BTS11 [label="BTS"]; |
||
25 | BSC1 [label="BSC"]; |
||
26 | |||
27 | User -> CBC [label="proprietaty"]; |
||
28 | CBC -> BSC [label="CBSP"]; |
||
29 | CBC -> BSC1 [label="CBSP"]; |
||
30 | BSC -> BTS0 [label="RSL"]; |
||
31 | BSC -> BTS1 [label="RSL"]; |
||
32 | BSC1 -> BTS10 [label="RSL"]; |
||
33 | BSC1 -> BTS11 [label="RSL"]; |
||
34 | BTS0 -> MS [label="CBCH"]; |
||
35 | } |
||
36 | }} |
||
37 | 20 | laforge | |
38 | h3. Ladder Diagram |
||
39 | |||
40 | This ladder diagram shows the propagation / flow of messages across the Cell Broadcast enabled network. |
||
41 | |||
42 | !osmodevcon2019-cell_broadcast__2.png! |
||
43 | 19 | laforge | |
44 | 2 | laforge | h2. Use Cases |
45 | 1 | laforge | |
46 | 2 | laforge | Cell Broadcast was used for various different use cases primarily in the 1990ies and early 2000s, including |
47 | * advertisement of the GPS position of the cell tower you're currently camping on |
||
48 | * advertisement of the calling codes of your current "home zone", i.e. a "lower cost short distance" call zone travelling with you as you roam around. |
||
49 | |||
50 | More recently, SMS-CB is seeing some uptake by various desaster warning systems, such as |
||
51 | * CMAS (Commercial Mobile Alert System), later renamed to WEA ("Wireless Emergency Alerts":https://en.wikipedia.org/wiki/Wireless_Emergency_Alerts) in the US. |
||
52 | * EU-Alert in the European union |
||
53 | * Messer Ishi (Rocket Alert) in Israel |
||
54 | * ETWS (Earthquake and Tsunami Warning System) in Japan |
||
55 | * KPAS (Korean Public Alert System) |
||
56 | |||
57 | 10 | laforge | h2. Osmocom Cell Broadcast support |
58 | 1 | laforge | |
59 | 18 | laforge | * [[OsmoBTS:]] implements |
60 | ** the CBCH channel (both BASIC and EXTENDED) in the SDCCH/4 and SDCCH/8 |
||
61 | ** the "SMS BROADCAST COMMAND" Message in RSL according to Section 8.5.8 of 3GPP TS 08.58 |
||
62 | ** the "CBCH LOAD INDICATION" Message in RSL, which allows the BSC to perform flow control of CBCH messages |
||
63 | * [[OsmoNITB:]] and [[OsmoBSC:]] implement a VTY command @bts <0-255> smscb-command <1-4> HEXSTRING@ to send a given hex-formatted cell broadcast message to a specified BTS (this is more a hack for manual testing) |
||
64 | 1 | laforge | ** you (obviously) first need to enable a timeslot/channel combination on the BTS that actually includes a CBCH, i.e. ccch+sdcch4+cbch or sdcch8+cbch |
65 | 18 | laforge | * [[OsmoBSC:]] implements |
66 | ** the scheduling / allocation of CBCH resources in presence of possibly many SMSCB messages, taking into account their message size, repetition period, duration |
||
67 | ** the CBSP protocol according to 3GPP TS 48.049 for interaction with a CBC |
||
68 | ** CBCH flow control based on incoming CBCH LOAD INDICATION via RSL from BTSs |
||
69 | ** transmission of SMSCB using SMS BROADCAST COMMAND via RSL to BTSs |
||
70 | * [[OsmoCBC:]] implements |
||
71 | * FIXME |
||
72 | 19 | laforge | |
73 | 1 | laforge | h3. How to test/use it |
74 | |||
75 | 18 | laforge | h4. Using recent OsmoBSC and OsmoCBC |
76 | 1 | laforge | |
77 | 18 | laforge | h5. make sure your related BTS is configured to use a channel combination with CBCH |
78 | 1 | laforge | |
79 | 21 | laforge | You have the choice of adding CBCH either on a a CCCH with SDCCH/4 or on a SDCCH/8. You will loose one of the SDCCHs in terms of capacity. |
80 | 18 | laforge | |
81 | 21 | laforge | Example: For using a combined CCCH with SDCCH/4 and CBCH you can use the following example snippet as part of osmo-bsc.cfg: |
82 | |||
83 | 18 | laforge | <pre> |
84 | network |
||
85 | bts 0 |
||
86 | trx 0 |
||
87 | timeslot 0 |
||
88 | phys_chan_config CCCH+SDCCH4+CBCH |
||
89 | 1 | laforge | </pre> |
90 | |||
91 | h5. Setting up OsmoCBC |
||
92 | |||
93 | 21 | laforge | Please see [[osmo-cbc:Quick_SMSCB_HOWTO]] and the "osmo-cbc user manual":https://ftp.osmocom.org/docs/latest/osmocbc-usermanual.pdf for further information. |
94 | 1 | laforge | |
95 | 21 | laforge | h4. DEPRECATED: Using the "manual hack" via BSC/NITB VTY command |
96 | 18 | laforge | |
97 | 21 | laforge | Before [[osmo-cbc:]] was implemented, we introduced a "manual hack" that allows the user of the BSC to send relatively raw RSL commands towards a BTS. |
98 | |||
99 | *Please don't use this method anymore, and instead use the osmo-cbc based method described above* |
||
100 | |||
101 | 18 | laforge | !osmocom-cbs.png! |
102 | |||
103 | This is sufficient for manual transmission of cell-broadcast messages in a lab environment or in small networks. The functionality has been developed and "used at the 31st annual CCC congress (31C3) to deliver spoofed _Presidential Level Alert_ messages":https://twitter.com/2b_as/status/549695235207737344/photo/1 |
||
104 | |||
105 | 10 | laforge | You need to perform two steps: |
106 | |||
107 | 18 | laforge | h5. make sure your related BTS is configured to use a channel combination with CBCH |
108 | 10 | laforge | |
109 | For using a combined CCCH with SDCCH/4 and CBCH you can use the following example snippet as part of osmo-bsc.cfg: |
||
110 | |||
111 | <pre> |
||
112 | network |
||
113 | 1 | laforge | bts 0 |
114 | 10 | laforge | trx 0 |
115 | timeslot 0 |
||
116 | phys_chan_config CCCH+SDCCH4+CBCH |
||
117 | </pre> |
||
118 | |||
119 | 1 | laforge | h5. telnet to osmo-bsc at port 4242, and enter something like |
120 | |||
121 | <pre> |
||
122 | enable |
||
123 | 10 | laforge | bts 0 smscb-command 1 001000320f1141660c344dd3cba09a0c |
124 | 1 | laforge | </pre> |
125 | 10 | laforge | |
126 | where "1" is the number of blocks required (each 22 bytes need one block) |
||
127 | and the hex-dump at the end is the encoded GSM 04.12 message to be broadcast. |
||
128 | 3 | laforge | |
129 | 2 | laforge | h2. Message Structure |
130 | |||
131 | * Message has maximum 15 pages |
||
132 | * Each page is 82 bytes of data, resulting in 93 characters in GSM 7-bit default alphabet |
||
133 | * Messges are broadcast on logical channels (more like an address) |
||
134 | * Subscribers can activate/deactivate selective addresses |
||
135 | |||
136 | h2. Further Reading |
||
137 | |||
138 | * ITU-T SG2 (Standardization of CB Channels) |
||
139 | * ETSI 102 444 |
||
140 | 9 | laforge | * "3GPP TS 23.041 GSM: Technical realization of Cell Broadcast Service (CBS)":https://www.etsi.org/deliver/etsi_ts/123000_123099/123041/15.02.00_60/ts_123041v150200p.pdf |
141 | * "3GPP TS 48.049 GSM: Baste Station Controller - Cell Broadcast Centre (BSC-CBC) interface specification; Cell Broadcast Service Protocol (CBSP)":https://www.etsi.org/deliver/etsi_ts/148000_148099/148049/15.00.00_60/ts_148049v150000p.pdf |
||
142 | 2 | laforge | * "3GPP TS 22.268 PWS: Public Warning System (PWS) requirements":http://www.etsi.org/deliver/etsi_ts/122200_122299/122268/14.00.00_60/ts_122268v140000p.pdf |
143 | 1 | laforge | * "3GPP TS 44.012 GSM: Short Message Service Cell Broadcast (SMSCB) support on the mobile radio interface":https://www.etsi.org/deliver/etsi_ts/144000_144099/144012/15.00.00_60/ts_144012v150000p.pdf |
144 | 14 | laforge | * "Whitepaper on Displaying Cell Broadcast":https://www.one2many.eu/assets/files/19_displaying-cb-messages.pdf |
145 | 2 | laforge | |
146 | h3. EU-Alert |
||
147 | |||
148 | 13 | laforge | * "ETSI/EMTEL TS 102 900":https://www.etsi.org/deliver/etsi_ts/102900_102999/102900/01.01.01_60/ts_102900v010101p.pdf |
149 | 2 | laforge | |
150 | h3. CMAS |
||
151 | |||
152 | 12 | laforge | * "FCC 08-99: First Report and Order":https://www.one2many.eu/assets/files/16_first-report-and-order.pdf |
153 | * "FCC 08-164: Second Report and Order":https://www.one2many.eu/assets/files/17_second-report-and-order.pdf |
||
154 | * "FCC 08-184: Third Report and Order":https://www.one2many.eu/assets/files/18_third-report-and-order.pdf |
||
155 | 15 | laforge | * "ATIS/TIA Standard J-STD-100 (Mobile Device Behavior)":https://global.ihs.com/doc_detail.cfm?&document_name=TIA%20J-STD-100 |
156 | * "ATIS/TIA Standard J-STD-101 (Federal Alert Gateway to CMSP Gateway Interface Spec)":https://global.ihs.com/doc_detail.cfm?&document_name=TIA%20J-STD-101 |
||
157 | * "ATIS/TIA Standard J-STD-102 (Federal Alert Gateway to CMSP Gateway Interface Test Spec)":https://global.ihs.com/doc_detail.cfm?&document_name=TIA%20J-STD-102 |
||
158 | 14 | laforge | * "ATIS 0700006 eWEA via GSM/UMTS Cell Broadcast Service Spec":https://global.ihs.com/doc_detail.cfm?document_name=ATIS%200700006 |
159 | * "ATIS 0700007 Implementation Guidelines and Best Practises for GSM/UMTS Cell Broadcast Service":https://global.ihs.com/doc_detail.cfm?document_name=ATIS%200700007 |
||
160 | * "ATIS 0700008 Cell Broadcast Entity (CBE)-to-Cell Broadcast Center (CBC) Interface Specification":https://global.ihs.com/doc_detail.cfm?document_name=ATIS%200700008 |
||
161 | * "ATIS 0700010 Enhanced Wireless Emergency Alert (eWEA) via EPS Public Warning System Specification":https://global.ihs.com/doc_detail.cfm?document_name=ATIS%200700010 |
||
162 | 2 | laforge | |
163 | h3. ETWS |
||
164 | 11 | laforge | |
165 | * "3GPP TS 22.168: ETWS Requirements Stage 1":https://www.etsi.org/deliver/etsi_ts/122100_122199/122168/08.03.00_60/ts_122168v080300p.pdf |
||
166 | * various modifications to TS 23.038, 23.401, 25.304, 25.331, see http://www.3gpp.org/DynaReport/WiCr--370051.htm |
||
167 | 17 | laforge | |
168 | h2. Cell Broadcast in 3G/UMTS |
||
169 | |||
170 | See [[Service_Area_Broadcast]] |
||
171 | |||
172 | h3. Cell Broadcast in 4G/LTE |
||
173 | |||
174 | h4. SBc interface between CBC and MME |
||
175 | |||
176 | The interface is based on a ASN.1 based protocol called SBc-AP which is specified in "3GPP TS 29.168":https://www.etsi.org/deliver/etsi_ts/129100_129199/129168/15.01.00_60/ts_129168v150100p.pdf |
||
177 | |||
178 | The protocol operates over SCTP. Connections are initiated by the CBC to the MME, and the MME listens for SBcAP connections on SCTP port 29168. |