Miscellaneous Projects » Mobile (in)Security

= RRLP =

RRLP is the ''Radio Resource LCS (Location Service) Protocol'' as specified first in GSM TS 03.41

It allows the GSM network operator to obtain very precise location information about a mobile phone,
much more precise than is required for normal operation of the cellular network.

The use of RRLP has been specified for emergency calls. However, nothing in its specification
restricts its use to this application.

In all known phones, RRLP operation is completely invisible to the user of the phone.

As GSM networks do not need to authenticate themselves, anyone can run a ''false BTS'' attack and
successively obtain precise position information on a given mobile phone.

RRLP Modes

RRLP operates in different ''modes''.

MS-based GPS

In this method, the phone operates a stand-alone GPS receiver like it can be found in personal navigation devices.

The GPS receiver will do the regular GPS receive process, i.e. * iterate over the list of 64 possible scrambling codes and acquire the C/A signal * decode the actual data signal modulated onto the C/A carrier * measure the timing difference of arrival (TDOA) of the various satellite signals * compute a location estimate (GPS coordinates) based on the measurements

This complete GPS position fix is then communicated to the SMLC inside the GSM core network.

=== Assistance Data ===

Most RRLP capable phones will request GPS assistance data from the network.

The operation of the GPS receiver is similar to the regular MS-based GPS aporach described above,
however the GPS receiver is now an A-GPS receiver that already knows the almanac/ephemeris data and
can thus much more quickly acquire the signal.

MS-assisted GPS

In MS-assisted GPS, the MS does not compute the actual location. Instead, the location/position
of the phone is computed in the SMLC (part of the GSM core network).

FIXME

E-OTD

FIXME