OpenBTS.org

Building Cellular Networks - Big or SmallMichael Iedema | @iedemam

OpenBTS.org

• what is OpenBTS

• GSM and SDR crash course

• converting between GSM and VoIP

• software and signaling support

• single tower to multi-tower

• APIs

• looking ahead

OpenBTS.org

What is OpenBTS

OpenBTS.org

OpenBTSis a transparent Open Source gateway between cellular handsets and VoIP networks

OpenBTS.org

OpenBTSimplements cellular radio interface standards in C++ and runs in userspace

OpenBTS.org

OpenBTSuses SDR (software defined radio) hardware instead of proprietary equipment

OpenBTS.org

OpenBTS turns this...

Abis

BTSBTSBSCA

BSC

VLR

MSCMSCHLRSS7-MAP

AuC

Radio

BH

GMSC

Nc

SGSN

Gb

GGSN

IP

InternetPSTN

Gn

Home Location RegisterAuthentication CenterMobile Switching CenterVisitor Location RegisterGateway Mobile Switching CenterBase Station ControllerServing GPRS Support NodeGateway GPRS Support NodeBase Transceiver Station

Modem

Handset

OpenBTS.org

...into this

Radio

PSTN ITSP Internet

IP

SIP/RTP

OpenBTSOpenBTS

SIP/RTP

Modem

Handset

Central ServicesSIP REGISTER

SIP INVITE

SIP MESSAGE

OpenBTS.org

GSM voice and SMSsupported cellular radio standards

OpenBTS.org

GPRS 2G datasupported cellular radio standards

OpenBTS.org

UMTS 3G datasupported cellular radio standards

OpenBTS.org

LTE (coming next year)supported cellular radio standards

OpenBTS.org

GSM and SDR Crash Course

OpenBTS.org

Overall Hierarchytower, sector, ARFCN, downlink/uplink, timeslot, logical channel, frame, burst

OpenBTS.org

towers can have multiple sectors

OpenBTS.org

sectors can have multiple ARFCNsAbsolute Radio Frequency Channel Numbers, also known as “carriers”

OpenBTS.org

each ARFCN has two frequenciesone for downlink and one for uplink, spaced by a specific offset

OpenBTS.org

downlink/uplink have 8 timeslotsGSM is both FDMA and TDMA

OpenBTS.org

timeslots have multiple logical channelsassigned in “combinations”

OpenBTS.org

logical channels are made of frames

OpenBTS.org

frames are made of bursts

OpenBTS.org

time for a visualizerdownlink, uplink, timeslots and combinations

OpenBTS.org

openbts.org/visualizer

OpenBTS.org

Logical Channels - BroadcastFCH, SCH, BCCH, CCCH, RACH

OpenBTS.org

FCH - Frequency Correction Channelcalibrates handset radio

OpenBTS.org

SCH - Synchronization Channelcalibrates handset scheduler

OpenBTS.org

BCCH - Broadcast Control Channelsends network identity and capability information

OpenBTS.org

CCCH - Common Control Channelallows network to page handsets

OpenBTS.org

RACH - Random Access Channelallows handsets to page network

OpenBTS.org

Logical Channels - DedicatedSDCCH, TCH

OpenBTS.org

SDCCH - Standalone Dedicated Control Channelsignaling traffic

OpenBTS.org

TCH - Traffic Channelmedia traffic

OpenBTS.org

time for another visualizer!timeslots and dedicated logical channels

OpenBTS.org

OperationsLUR, MOC, MTC, EmergencyCall, MOSMS, MTSMS

OpenBTS.org

LUR - Location Update Requesthandset registration with optional authentication

OpenBTS.org

MOC - Mobile Originated Call

OpenBTS.org

MTC - Mobile Terminated Call

OpenBTS.org

EmergencyCalltotally cool

OpenBTS.org

MOSMS - Mobile Originated SMS

OpenBTS.org

MTSMS - Mobile Terminated SMS

OpenBTS.org

SDRsSoftware Defined Radios

OpenBTS.org

completely generic radioSDRs

OpenBTS.org

all logic is in softwareSDRs

OpenBTS.org

differentiated by sensitivity...SDRs

OpenBTS.org

...frequency range...SDRs

OpenBTS.org

...and megasamples (bandwidth)SDRs

OpenBTS.org

monitor for: $25 radio + SDRSharphttp://www.rtl-sdr.com

OpenBTS.org

multiple concurrent logical radiosSDRs

OpenBTS.org

GSM to UMTS is a software upgradeSDRs

OpenBTS.org

Converting Between GSM and VoIP

OpenBTS.org

MOC, MTC = SIP INVITE

SIP Switch OpenBTS Handset

IMMED. ASSIGN.

CHAN. REQ.

RTP traffic GSM traffic

CM SVC. REQ.

CM SVC. ACCEPT

SETUP

INVITE CALL PROCEEDING

Status: 182 RingingALERTING

Status: 200 OKCONNECT

CONNECT ACK.

Status: 100 Trying

SIP Switch OpenBTS Handset

IMMED. ASSIGN.

CHAN. REQ.

RTP traffic GSM traffic

CM SVC. REQ.

CM SVC. ACCEPT

SETUP

INVITE CALL PROCEEDING

Status: 182 RingingALERTING

Status: 200 OKCONNECT

CONNECT ACK.

Status: 100 Trying

RR

MM

CC

SIP Switch OpenBTS Handset

IMMED. ASSIGN.

CHAN. REQ.

RTP traffic GSM traffic

CM SVC. REQ.

CM SVC. ACCEPT

SETUP

INVITE CALL PROCEEDING

Status: 182 RingingALERTING

Status: 200 OKCONNECT

CONNECT ACK.

Status: 100 Trying

SIP Switch OpenBTS Handset

IMMED. ASSIGN.

CHAN. REQ.

RTP traffic GSM traffic

CM SVC. REQ.

CM SVC. ACCEPT

SETUP

INVITE CALL PROCEEDING

Status: 182 RingingALERTING

Status: 200 OKCONNECT

CONNECT ACK.

Status: 100 Trying

OpenBTS.org

MOSMS, MTSMS = SIP MESSAGE

OpenBTS.org

LUR = SIP REGISTERboth use digest style authentication, mapping to SIP is surprisingly easy

OpenBTS.org

LUR = SIP REGISTERRAND = nonce | A3 = MD5 | SRES = response

OpenBTS.org

“algorithm=MD5”RFC does not limit this algorithm, more choices needed in SIP software

OpenBTS.org

Software and Signaling Support

OpenBTS.org

Keep in Mind: GSM Network Arch

Abis

BTSBTSBSCA

BSC

VLR

MSCMSCHLRSS7-MAP

AuC

Radio

BH

GMSC

Nc

SGSN

Gb

GGSN

IP

InternetPSTN

Gn

Home Location RegisterAuthentication CenterMobile Switching CenterVisitor Location RegisterGateway Mobile Switching CenterBase Station ControllerServing GPRS Support NodeGateway GPRS Support NodeBase Transceiver Station

Modem

Handset

OpenBTS.org

Original IP Architecturetested and supported since project inception

OpenBTS.org

Radio

PSTN ITSP Internet

IP

SIP/RTP

OpenBTSOpenBTS

SIP/RTP

Modem

Handset

Central ServicesSIPAuthServe

Asterisk

SMQueue

Original IP Architecture

OpenBTS.org

Kazoo Architecturecomplete integration, no difference between a deskphone or a GSM handset

OpenBTS.org

Kazoo Architecture

Radio

PSTN ITSP Internet

IP

SIP/RTP

OpenBTSOpenBTS

Erlang

Modem

Handset

KazooAuthorization Server

Voice Switch

Message Queue

FreeSWITCHSIP/RTP

OpenBTS.org

Direct Architecturepatches being written for Asterisk and FreeSWITCH

OpenBTS.org

Direct Architectureadding A3 algorithm to SIP authentication is easy

OpenBTS.org

Direct Architecturestore-and-forward SIP MESSAGE support is still missing

OpenBTS.org

Direct Architecture

Radio

PSTN ITSP Internet

IP

SIP/RTP

OpenBTSOpenBTS

SIP/RTP

Modem

Handset

Central ServicesAsterisk/FreeSWITCH

OpenBTS.org

Direct Architectureinstall OpenBTS, point at existing PBX, done

OpenBTS.org

Direct ArchitectureAskozia has a beta with these patches integrated

OpenBTS.org

Single Tower to Multi-Tower

OpenBTS.org

a “tower” is not a tower

OpenBTS.org

single tower“network-in-a-box”

Mobile Station

Radio Hardware Transceiver Software

OpenBTS

Raw Samples over UDPRaw Samples

Over USB or Ethernet

GSM Radio (Um)Interface

SIPAuthServeGSM LUR

SIP REGISTER

SMQueueGSM SMS

SIP MESSAGE

AsteriskGSM VoiceSIP INVITE

SIP and RTP over UDP

antenna alignment

In OutTx Rx

Amplifier

Tx Rx

DuplexerRadio

stronger cleaner signals

OpenBTS.org

multi-tower

Tower 1

Central Services

OpenBTS

SIPAuthServeSIP REGISTER

SMQueueSIP MESSAGE

AsteriskSIP INVITE

SIP/RTPSIP/RTP

Tower 2OpenBTS

OpenBTS.org

MCC, MNC, NCCmulti-tower - network identity

OpenBTS.org

LAC, CI, BCCmulti-tower - base station identity

ARFCN: 172BCC: 4

ARFCN: 170BCC: 3

ARFCN: 166BCC: 1

ARFCN: 168BCC: 2

ARFCN: 174BCC: 5

ARFCN: 172BCC: 4

ARFCN: 168BCC: 2

ARFCN: 166BCC: 1

ARFCN: 174BCC: 5

ARFCN: 170BCC: 3

ARFCN: 166BCC: 1

ARFCN: 168BCC: 2

ARFCN: 174BCC: 5

ARFCN: 172BCC: 4

ARFCN: 168BCC: 2

ARFCN: 166BCC: 1

ARFCN: 170BCC: 3

50 m 100 mW

ARFCN: 172BCC: 4

ARFCN: 170BCC: 3

ARFCN: 166BCC: 1

ARFCN: 168BCC: 2

ARFCN: 174BCC: 5

ARFCN: 172BCC: 4

ARFCN: 168BCC: 2

ARFCN: 166BCC: 1

ARFCN: 174BCC: 5

ARFCN: 170BCC: 3

ARFCN: 166BCC: 1

ARFCN: 168BCC: 2

ARFCN: 174BCC: 5

ARFCN: 172BCC: 4

ARFCN: 168BCC: 2

ARFCN: 166BCC: 1

ARFCN: 170BCC: 3

5 km 10 W

OpenBTS.org

multiple physical signals, one logical network

OpenBTS.org

Mobility, Handover and Roamingnon-interchangeable terms

OpenBTS.org

Mobilitywhen idle, handset decides which tower is best

OpenBTS.org

Handoveron an active call, network tells handset to change towers

OpenBTS.org

Roamingmobility between different service providers

OpenBTS.org

APIs

OpenBTS.org

PhysicalStatus API

OpenBTS.org

{ "name" : "PhysicalStatus", "timestamp" : "18446744072283447705", "version" : "0.1", "data" : { "burst" : { "RSSI" : -49.4808, "RSSP" : -27.4808, "actualMSPower" : 11, "actualMSTimingAdvance" : 0, "timingError" : 1.59709 }, "channel" : { "ARFCN" : 153, "IMSI" : "001010000000001", "carrierNumber" : 0, "timeslotNumber" : 0, "typeAndOffset" : "SDCCH/4-1", "uplinkFrameErrorRate" : 0 }, "reports" : { "neighboringCells" : [], "servingCell" : { "RXLEVEL_FULL_dBm" : -67, "RXLEVEL_SUB_dBm" : -67, "RXQUALITY_FULL_BER" : 0, "RXQUALITY_SUB_BER" : 0 } } }}

OpenBTS.org

search and rescuePhysicalStatus API

OpenBTS.org

traffic reportsPhysicalStatus API

OpenBTS.org

automatic site surveyPhysicalStatus API

OpenBTS.org

power modelingPhysicalStatus API

OpenBTS.org

ARFCN visualizerPhysicalStatus API

OpenBTS.org

IMSI visualizerPhysicalStatus API

OpenBTS.org

other APIsconfig, monitor, version, imsis, etc...

OpenBTS.org

Looking Ahead

OpenBTS.org

licensed frequencythe biggest problem at the moment

OpenBTS.org

licensed frequencysome European countries opening up public guard bands

OpenBTS.org

licensed frequencyother countries reallocating unused spectrum more granularly

OpenBTS.org

smartphoneslots of innovation

OpenBTS.org

“the cloud”lots of innovation

OpenBTS.org

the cellular core networkstagnant

OpenBTS.org

it’s an IP worldlove it or hate it

OpenBTS.org

it’s an IP worldbut backwards compatibility is so cool, right?

OpenBTS.org

it’s an IP worldDTMF

OpenBTS.org

it’s an IP worldFax

OpenBTS.org

it’s an IP worldcellular radio air interface protocols

OpenBTS.org

Questions

mriedema@gmail.comtwitter.com/iedemam

twitter.com/openbtshttps://github.com/RangeNetworks/presentations/