Upload
bryce-delane
View
222
Download
2
Tags:
Embed Size (px)
Citation preview
Copyright © 2007, Tim Moors
Locating Users of Mobile Phones
Tim MoorsSenior Lecturer
School of Electrical Engineering and TelecommunicationsUniversity of New South Wales
Sydney, NSW, Australia
2
Copyright © 2007, Tim Moors
Outline
• Generations of mobile phones• Phone identifiers• Cellular location
• Cellular communication• The communication process• Physical cell selection
• Other locators• Summary and Questions
3
Copyright © 2007, Tim Moors
Generations of mobile phonesCellular? Digital? Provision for “data” Rate
0
1
2
2.5
3
3.5
4?
No No No No 8kHz
Yes No No No 8kHz
Yes Yes Yes No 9.6kb/s
Yes Yes Yes No 114kb/s
Yes Yes Yes No 384kb/s
Yes Yes Yes No 14.4Mb/s
Yes Yes Yes Yes ?
VOIP = Voice Over Internet Protocol
Support? VOIPYear
1970s
1981
1993
1990s
2000
today
?
GNames
MTS
AMPS
GSM
GPRS
IMT-2000
HSPA
?
http://park.org/Japan/NTT/DM/images/RF004900_s.gifhttp://luciafreitas.tripod.com/umpoucodetudo/EricssonHotLine.jpghttp://www.mobilebulgaria.com/uploads/mobiles/2004/01/pic_3_484.jpghttp://www.three.com.auwww.belkin.com/skype/howitworks/
4
Copyright © 2007, Tim Moors
Handset serial number:International Mobile Equipment Identity (IMEI)
• principally for locking phone to a service; theoretically also to block stolen handsets
• press “*# 06 #” to view
SIM card (“dual SIM” in some phones)16kB-512kB memory contains:• address book, personal settings, etc• codes for securing access to phone, network• International Mobile Subscriber Identity (IMSI):
Identifies phone within mobile phone system
“Phone number”Mobile Station Integrated Services Digital Network (identifier) (MSISDN)
translated to IMSI at edge of mobile phone system
We usually want to locate people, not phones.
Phone identifiers
SIM = subscriber identity module
#
5
Copyright © 2007, Tim Moors
Outline
• Generations of mobile phones• Phone identifiers• Cellular location
• Cellular communication• Mobile vs cellular phones• Why cellular?• Base station snapshots• Cellular issues
• The communication process• Physical cell selection
• Other locators• Summary and Questions
6
Copyright © 2007, Tim Moors
Mobile vs cellular phones
Radio range is limited by:• power (limited by mobility and health), • antennas, • noise/interference level, and • signal processing
Typical potential range: 10s of km in freespace (e.g. pastoral)• Usually don’t use full range due to congestive effects
• Typical suburban effective range: 3km• Temporary base stations installed for large events
e.g. New Years Eve on Sydney Harbour• Real environments aren’t freespace; have “clutter”
e.g. terrain, buildings, vegetation, mobile vehicles/people may find blackspots in buildings only kms from base station
Location of mobile phones is often based on this limited range.
Current phones are cellular, despite being called “mobile” in Aust.
7
Copyright © 2007, Tim Moors
Why cellular?
Confining signals: allows a frequency to be concurrently used
elsewhere, raising capacity reduces power needed,
shrink battery/elongate lifetime contains base station faults
Hexagonal cells tessellateand approximate circles(distance = main determinant of quality)
Usually sectorise cells triplets of directional antennas in a triangular arrangement on tower
8
Copyright © 2007, Tim Moors
Base station snapshots
9
Copyright © 2007, Tim Moors
Cellular issues
• Cell density should reflect subscriber density Better localisation in denser (e.g. urban) areas
Subscribers need to determine power level to use:1. Mobiles measures strength and error rate2. Mobile notifies Base Station3. Base Station indicates what power level to use
• Base Station position subject to available real estate• Signals don’t propagate in free space
Real cells aren’t neat hexagons Complex to determine which tower covers a particular point
• Phone system needs to• locate mobile user in order to establish call to it• “handover” mobile users between towers.
Handover also used to shift load during congestionBut logs generally record first cell, before any handover
10
Copyright © 2007, Tim Moors
Outline
• Generations of mobile phones• Phone identifiers• Cellular location
• Cellular communication• The communication process
• Frequencies• Signalling channels• Ephemeral location for call setup• What gets logged?
• Physical cell selection• Other locators• Summary and Questions
11
Copyright © 2007, Tim Moors
Frequencies
Bands of frequencies are divided into channels, assigned to different telcos, divided amongst calls.
Bands:• Main GSM bands: (others: 850MHz, 1900MHz)
• 900MHz (890-915, 935-960MHz)• 1800MHz (1710-1785, 1805-1880)
• Main 3G band: 2100MHz (Telstra on 850MHz)Time-division of channel 8 calls
Effect on location:• # antennas: Separate antennas for each band
more antennas more directivity• Logged band: 900MHz propagates better than 1800MHz
usually establish calls on 900MHz, then hand over to 1800MHz if quality OK most calls logged as established on a 900MHz cell
125 channels375 channels
12
Copyright © 2007, Tim Moors
Signalling channels• Broadcast: Base Station announces identity and frequency
parameters• Common Control Channels
• Paging: for Base Station to notify phone of a call• Random access: for phone to request access; response comes on an...• “Access grant” channel: Indicates which Dedicated Control Channel to
use• Dedicated Control Channel: Dedicated to a specific call (e.g. to
control handset power)
Basic call processes:1. Phone monitors Broadcast ch. to identify local Base Stations2. Phone chooses Base Station, by strongest signal3. Phone requests access using Random Access Channel
If (unlikely) can’t access best Base Station (due to interference or congestion on Random Access Channel); then try 2nd best
4. Base station indicates channels (DCCH and voice) to use(Receiving call: Paging rather than request access + Access grant)
13
Copyright © 2007, Tim Moors
Ephemeral location for call setupNeed to track location of phone in order to call it“location areas” are non-overlapping groups of cells; larger areas: Reduce frequency of location updates = mobile transmissions Increase area covered when paging = mobile receipts and traffic
Location Registers:• Phone number home MSC Home LR
• tracks subscriber’s location• records ‘service profile’ (e.g. caller ID, SMS, etc)
• Each location area has a Visitor LR
Location update process:1. Mobile identifies new cell (through Broadcast)2. Mobile reports to new Visitor LR for that cell3. New Visitor LR notifies Home LR of location4. HLR replies to new VLR with user’s ‘service profile’
then tells old VLR to delete recordCalls to mobile go through HLR to current location;
page to determine cell within the location area
Location is updated whenever phone is on(not just during call setup)
Information is ephemeral
14
Copyright © 2007, Tim Moors
What gets logged?
Logs are kept for• both pre-paid and plan-based phones• voice (“regular”) calls and messages
Available (to telco) in various forms:• “cell dump”: All calls through a certain Base Station or cell• “Call Charge Record”: for a particular phone (IMEI or MSISDN)
What gets logged:• Date & time (when call was established), duration• Phone numbers (MSISDN) of both parties• Record Type: Numeric code indicating:
• Voice or message• Which party initiated the call
• IMEI of the mobile handset (served by this telco)• Cell IDs
• First Cell ID: Where the call was established[Cells traversed during call are not logged]
• Last Cell ID: Where the call was released (A recent addition to logs.)
15
Copyright © 2007, Tim Moors
Outline
• Generations of mobile phones• Phone identifiers• Cellular location
• Cellular communication• The communication process• Physical cell selection
• Sample antenna• Choosing which cell of a tower• Choosing which tower
• Other locators• Summary and Questions
16
Copyright © 2007, Tim Moors
Sample antenna
Argus Antennas JPX310D
JPX310D AzimuthElevation
Pictures from http://www.argusantennas.com/main/?c=custom/argus&custom/argus_task=view_product&product_code=JPX310D&mode=generic
17
Copyright © 2007, Tim Moors
Choosing which cell of a tower
Environmental factors equally affect allantennas on a tower since they are effectively co-located
(c.f. choosing which tower)
Choice of cell affected only by:• Radiation patterns
typically symmetrical• Resolution with which phone
can distinguish signal strengths• Uncertain: No worse than bar display,
but unsure of requisite and signalling accuracy• Grey area of +/- 10 degrees around demarcation line
18
Copyright © 2007, Tim Moors
Choosing which tower
Signal strength diminishes with distance,as energy is dissipated and absorbed
Signals can be absorbed by obstructions (terrain, buildings, people) reflected, particularly by metal (rooves, vehicles)
• generally weaker than direct signal, butmay be all that is available in a dense environment.
received through multiple paths, which may interfere(constructively or destructively,depending on multiples of wavelength 30cm)
Telcos• Predict coverage, based on
antennas and propagation & terrain models• Measure actual coverage, e.g. with cherry picker tower /
monitoring & positioning equipment in boots of taxis• Produce “Cell Coverage Maps” indicating the expected
“dominant cell” for each point
Note: Devices are ambivalent to distance; only aware of signal strength
19
Copyright © 2007, Tim Moors
Outline
• Generations of mobile phones• Phone identifiers• Cellular location
• Cellular communication• The communication process• Physical cell selection
• Other locators• Who cares where you are?• Sources of location info• E911
• Summary and Questions
20
Copyright © 2007, Tim Moors
Who cares where you are?
Consumers• Where am I?• Where is the closest xyz?• Where is my daughter?
Telco• Derived from consumer demand• To customise content (e.g. ads for local businesses)• Capacity planning• New services, e.g. road traffic conditions• Obliged to help:
Emergency servicese.g. for people who are lost, or unable to
Law enforcement
21
Copyright © 2007, Tim Moors
Sources of location info
Image from optus.com.au: Homepage / Personal / Mobile / 3G Mobile / FindA; drawing from http://www.acma.gov.au/webwr/consumer_info/location.pdf
Cell identitye.g. Optus FindA service
Measurements of phone emanations• strength• timing• direction (in future, using steerable
antennas)Direction finding well established for
wildlife, military; but needs to be done live traditionally exceptional;only now potentially normal.
Positioning systems, e.g. GPS• Works best outdoors• Handset-based privacy through
handset control of disclosure
22
Copyright © 2007, Tim Moors
E911Telco provides address associated with caller to direct emergency
servicesFCC has Enhanced 911 (E911) for mobile & VOIP users
Legislation gives carriers choices:Location Popularity 67% within 95% withinhandset 60% 50m 150mnetwork 20% 100m 300mhybrid 20%
Timing:1996: Development started (pre 9/11, but never only for emergency services)1999: Wireless Communication and Public Safety Act2003: 100% of handsets due to be compatible; few carriers met schedule
Similar efforts in• Europe: “Coordination Group on Access to Location Information for
Emergency Services”; more concern for privacy• Australia: ACMA discussion paper in 2004
23
Copyright © 2007, Tim Moors
Summary
• Most current capacity to locate mobile phones due is to the cellular nature of communication• cells are a couple of km wide• 120O sectors around towers, with 20O grey areas• Choice between towers heavily influenced by terrestrial
“clutter”• Logs only record first (& recently last) cell for a call• System tracks, but doesn’t preserve, location area of phones
that are on• Location services are increasing in importance
• to customers• to telcos• to law enforcement...
Copyright © 2007, Tim Moors
Locating Users of Mobile Phones
Tim MoorsSenior Lecturer
School of Electrical Engineering and TelecommunicationsUniversity of New South Wales
Sydney, NSW, Australia
Questions?