OpenBTS - Building Real Mobile Networks, Big or Small
-
Upload
elastix -
Category
Technology
-
view
367 -
download
6
Transcript of OpenBTS - Building Real Mobile Networks, Big or Small
OpenBTS.org
Building Cellular Networks - Big or SmallMichael Iedema | @iedemam
OpenBTS.org
• what is OpenBTS
• GSM and SDR crash course
• converting between GSM and VoIP
• software and signaling support
• single tower to multi-tower
• APIs
• looking ahead
OpenBTS.org
What is OpenBTS
OpenBTS.org
OpenBTSis a transparent Open Source gateway between cellular handsets and VoIP networks
OpenBTS.org
OpenBTSimplements cellular radio interface standards in C++ and runs in userspace
OpenBTS.org
OpenBTSuses SDR (software defined radio) hardware instead of proprietary equipment
OpenBTS.org
OpenBTS turns this...
Abis
BTSBTSBSCA
BSC
VLR
MSCMSCHLRSS7-MAP
AuC
Radio
BH
GMSC
Nc
SGSN
Gb
GGSN
IP
InternetPSTN
Gn
Home Location RegisterAuthentication CenterMobile Switching CenterVisitor Location RegisterGateway Mobile Switching CenterBase Station ControllerServing GPRS Support NodeGateway GPRS Support NodeBase Transceiver Station
Modem
Handset
OpenBTS.org
...into this
Radio
PSTN ITSP Internet
IP
SIP/RTP
OpenBTSOpenBTS
SIP/RTP
Modem
Handset
Central ServicesSIP REGISTER
SIP INVITE
SIP MESSAGE
OpenBTS.org
GSM voice and SMSsupported cellular radio standards
OpenBTS.org
GPRS 2G datasupported cellular radio standards
OpenBTS.org
UMTS 3G datasupported cellular radio standards
OpenBTS.org
LTE (coming next year)supported cellular radio standards
OpenBTS.org
GSM and SDR Crash Course
OpenBTS.org
Overall Hierarchytower, sector, ARFCN, downlink/uplink, timeslot, logical channel, frame, burst
OpenBTS.org
towers can have multiple sectors
OpenBTS.org
sectors can have multiple ARFCNsAbsolute Radio Frequency Channel Numbers, also known as “carriers”
OpenBTS.org
each ARFCN has two frequenciesone for downlink and one for uplink, spaced by a specific offset
OpenBTS.org
downlink/uplink have 8 timeslotsGSM is both FDMA and TDMA
OpenBTS.org
timeslots have multiple logical channelsassigned in “combinations”
OpenBTS.org
logical channels are made of frames
OpenBTS.org
frames are made of bursts
OpenBTS.org
time for a visualizerdownlink, uplink, timeslots and combinations
OpenBTS.org
Logical Channels - BroadcastFCH, SCH, BCCH, CCCH, RACH
OpenBTS.org
FCH - Frequency Correction Channelcalibrates handset radio
OpenBTS.org
SCH - Synchronization Channelcalibrates handset scheduler
OpenBTS.org
BCCH - Broadcast Control Channelsends network identity and capability information
OpenBTS.org
CCCH - Common Control Channelallows network to page handsets
OpenBTS.org
RACH - Random Access Channelallows handsets to page network
OpenBTS.org
Logical Channels - DedicatedSDCCH, TCH
OpenBTS.org
SDCCH - Standalone Dedicated Control Channelsignaling traffic
OpenBTS.org
TCH - Traffic Channelmedia traffic
OpenBTS.org
time for another visualizer!timeslots and dedicated logical channels
OpenBTS.org
OperationsLUR, MOC, MTC, EmergencyCall, MOSMS, MTSMS
OpenBTS.org
LUR - Location Update Requesthandset registration with optional authentication
OpenBTS.org
MOC - Mobile Originated Call
OpenBTS.org
MTC - Mobile Terminated Call
OpenBTS.org
EmergencyCalltotally cool
OpenBTS.org
MOSMS - Mobile Originated SMS
OpenBTS.org
MTSMS - Mobile Terminated SMS
OpenBTS.org
SDRsSoftware Defined Radios
OpenBTS.org
completely generic radioSDRs
OpenBTS.org
all logic is in softwareSDRs
OpenBTS.org
differentiated by sensitivity...SDRs
OpenBTS.org
...frequency range...SDRs
OpenBTS.org
...and megasamples (bandwidth)SDRs
OpenBTS.org
monitor for: $25 radio + SDRSharphttp://www.rtl-sdr.com
OpenBTS.org
multiple concurrent logical radiosSDRs
OpenBTS.org
GSM to UMTS is a software upgradeSDRs
OpenBTS.org
Converting Between GSM and VoIP
OpenBTS.org
MOC, MTC = SIP INVITE
SIP Switch OpenBTS Handset
IMMED. ASSIGN.
CHAN. REQ.
RTP traffic GSM traffic
CM SVC. REQ.
CM SVC. ACCEPT
SETUP
INVITE CALL PROCEEDING
Status: 182 RingingALERTING
Status: 200 OKCONNECT
CONNECT ACK.
Status: 100 Trying
SIP Switch OpenBTS Handset
IMMED. ASSIGN.
CHAN. REQ.
RTP traffic GSM traffic
CM SVC. REQ.
CM SVC. ACCEPT
SETUP
INVITE CALL PROCEEDING
Status: 182 RingingALERTING
Status: 200 OKCONNECT
CONNECT ACK.
Status: 100 Trying
RR
MM
CC
SIP Switch OpenBTS Handset
IMMED. ASSIGN.
CHAN. REQ.
RTP traffic GSM traffic
CM SVC. REQ.
CM SVC. ACCEPT
SETUP
INVITE CALL PROCEEDING
Status: 182 RingingALERTING
Status: 200 OKCONNECT
CONNECT ACK.
Status: 100 Trying
SIP Switch OpenBTS Handset
IMMED. ASSIGN.
CHAN. REQ.
RTP traffic GSM traffic
CM SVC. REQ.
CM SVC. ACCEPT
SETUP
INVITE CALL PROCEEDING
Status: 182 RingingALERTING
Status: 200 OKCONNECT
CONNECT ACK.
Status: 100 Trying
OpenBTS.org
MOSMS, MTSMS = SIP MESSAGE
OpenBTS.org
LUR = SIP REGISTERboth use digest style authentication, mapping to SIP is surprisingly easy
OpenBTS.org
LUR = SIP REGISTERRAND = nonce | A3 = MD5 | SRES = response
OpenBTS.org
“algorithm=MD5”RFC does not limit this algorithm, more choices needed in SIP software
OpenBTS.org
Software and Signaling Support
OpenBTS.org
Keep in Mind: GSM Network Arch
Abis
BTSBTSBSCA
BSC
VLR
MSCMSCHLRSS7-MAP
AuC
Radio
BH
GMSC
Nc
SGSN
Gb
GGSN
IP
InternetPSTN
Gn
Home Location RegisterAuthentication CenterMobile Switching CenterVisitor Location RegisterGateway Mobile Switching CenterBase Station ControllerServing GPRS Support NodeGateway GPRS Support NodeBase Transceiver Station
Modem
Handset
OpenBTS.org
Original IP Architecturetested and supported since project inception
OpenBTS.org
Radio
PSTN ITSP Internet
IP
SIP/RTP
OpenBTSOpenBTS
SIP/RTP
Modem
Handset
Central ServicesSIPAuthServe
Asterisk
SMQueue
Original IP Architecture
OpenBTS.org
Kazoo Architecturecomplete integration, no difference between a deskphone or a GSM handset
OpenBTS.org
Kazoo Architecture
Radio
PSTN ITSP Internet
IP
SIP/RTP
OpenBTSOpenBTS
Erlang
Modem
Handset
KazooAuthorization Server
Voice Switch
Message Queue
FreeSWITCHSIP/RTP
OpenBTS.org
Direct Architecturepatches being written for Asterisk and FreeSWITCH
OpenBTS.org
Direct Architectureadding A3 algorithm to SIP authentication is easy
OpenBTS.org
Direct Architecturestore-and-forward SIP MESSAGE support is still missing
OpenBTS.org
Direct Architecture
Radio
PSTN ITSP Internet
IP
SIP/RTP
OpenBTSOpenBTS
SIP/RTP
Modem
Handset
Central ServicesAsterisk/FreeSWITCH
OpenBTS.org
Direct Architectureinstall OpenBTS, point at existing PBX, done
OpenBTS.org
Direct ArchitectureAskozia has a beta with these patches integrated
OpenBTS.org
Single Tower to Multi-Tower
OpenBTS.org
a “tower” is not a tower
OpenBTS.org
single tower“network-in-a-box”
Mobile Station
Radio Hardware Transceiver Software
OpenBTS
Raw Samples over UDPRaw Samples
Over USB or Ethernet
GSM Radio (Um)Interface
SIPAuthServeGSM LUR
SIP REGISTER
SMQueueGSM SMS
SIP MESSAGE
AsteriskGSM VoiceSIP INVITE
SIP and RTP over UDP
antenna alignment
In OutTx Rx
Amplifier
Tx Rx
DuplexerRadio
stronger cleaner signals
OpenBTS.org
multi-tower
Tower 1
Central Services
OpenBTS
SIPAuthServeSIP REGISTER
SMQueueSIP MESSAGE
AsteriskSIP INVITE
SIP/RTPSIP/RTP
Tower 2OpenBTS
OpenBTS.org
MCC, MNC, NCCmulti-tower - network identity
OpenBTS.org
LAC, CI, BCCmulti-tower - base station identity
ARFCN: 172BCC: 4
ARFCN: 170BCC: 3
ARFCN: 166BCC: 1
ARFCN: 168BCC: 2
ARFCN: 174BCC: 5
ARFCN: 172BCC: 4
ARFCN: 168BCC: 2
ARFCN: 166BCC: 1
ARFCN: 174BCC: 5
ARFCN: 170BCC: 3
ARFCN: 166BCC: 1
ARFCN: 168BCC: 2
ARFCN: 174BCC: 5
ARFCN: 172BCC: 4
ARFCN: 168BCC: 2
ARFCN: 166BCC: 1
ARFCN: 170BCC: 3
50 m 100 mW
ARFCN: 172BCC: 4
ARFCN: 170BCC: 3
ARFCN: 166BCC: 1
ARFCN: 168BCC: 2
ARFCN: 174BCC: 5
ARFCN: 172BCC: 4
ARFCN: 168BCC: 2
ARFCN: 166BCC: 1
ARFCN: 174BCC: 5
ARFCN: 170BCC: 3
ARFCN: 166BCC: 1
ARFCN: 168BCC: 2
ARFCN: 174BCC: 5
ARFCN: 172BCC: 4
ARFCN: 168BCC: 2
ARFCN: 166BCC: 1
ARFCN: 170BCC: 3
5 km 10 W
OpenBTS.org
multiple physical signals, one logical network
OpenBTS.org
Mobility, Handover and Roamingnon-interchangeable terms
OpenBTS.org
Mobilitywhen idle, handset decides which tower is best
OpenBTS.org
Handoveron an active call, network tells handset to change towers
OpenBTS.org
Roamingmobility between different service providers
OpenBTS.org
APIs
OpenBTS.org
PhysicalStatus API
OpenBTS.org
{ "name" : "PhysicalStatus", "timestamp" : "18446744072283447705", "version" : "0.1", "data" : { "burst" : { "RSSI" : -49.4808, "RSSP" : -27.4808, "actualMSPower" : 11, "actualMSTimingAdvance" : 0, "timingError" : 1.59709 }, "channel" : { "ARFCN" : 153, "IMSI" : "001010000000001", "carrierNumber" : 0, "timeslotNumber" : 0, "typeAndOffset" : "SDCCH/4-1", "uplinkFrameErrorRate" : 0 }, "reports" : { "neighboringCells" : [], "servingCell" : { "RXLEVEL_FULL_dBm" : -67, "RXLEVEL_SUB_dBm" : -67, "RXQUALITY_FULL_BER" : 0, "RXQUALITY_SUB_BER" : 0 } } }}
OpenBTS.org
search and rescuePhysicalStatus API
OpenBTS.org
traffic reportsPhysicalStatus API
OpenBTS.org
automatic site surveyPhysicalStatus API
OpenBTS.org
power modelingPhysicalStatus API
OpenBTS.org
ARFCN visualizerPhysicalStatus API
OpenBTS.org
IMSI visualizerPhysicalStatus API
OpenBTS.org
other APIsconfig, monitor, version, imsis, etc...
OpenBTS.org
Looking Ahead
OpenBTS.org
licensed frequencythe biggest problem at the moment
OpenBTS.org
licensed frequencysome European countries opening up public guard bands
OpenBTS.org
licensed frequencyother countries reallocating unused spectrum more granularly
OpenBTS.org
smartphoneslots of innovation
OpenBTS.org
“the cloud”lots of innovation
OpenBTS.org
the cellular core networkstagnant
OpenBTS.org
it’s an IP worldlove it or hate it
OpenBTS.org
it’s an IP worldbut backwards compatibility is so cool, right?
OpenBTS.org
it’s an IP worldDTMF
OpenBTS.org
it’s an IP worldFax
OpenBTS.org
it’s an IP worldcellular radio air interface protocols
OpenBTS.org
Questions
[email protected]/iedemam
twitter.com/openbtshttps://github.com/RangeNetworks/presentations/