summaryrefslogtreecommitdiff
path: root/2019/osmodevcon2019-cell_broadcast/osmodevcon2019-cell_broadcast.adoc
blob: 3089585e6fd24a388b61eea82968899b56a04514 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
Cell Broadcast for Osmocom
==========================
:author:	Harald Welte <laforge@gnumonks.org>
:copyright:	2019 by Harald Welte (License: CC-BY-SA)
:backend:	slidy
:max-width:	45em


== Cell Broadcast

* classic GSM (and other 3GPP) are point-to-point
** limited radio resources means limited concurrent communication
* exotic options for point-to-multipoint
** VGCS/VBS (voice group/broadcast calls) exist only in GSM-R
** MBMS (never deployed in 2G/3G) adds multicast packet service
* this leaves cell broadcast as the *only* fast way to send informations to many subscribers at once
** main use case: emergency / disaster warning

== Message Structure

* Message has maximum 15 pages
* Each page is 82 bytes of data, resulting in 93 characters in GSM 7-bit default alphabet
* Messges are broadcast on logical channels (more like an address)
* Subscribers can activate/deactivate selective addresses
* 3GPP TS 03.41 / 23.041

== Cell Broadcast in GSM

[graphviz]
----
digraph G {
  BTS0 [label="BTS"];
  BTS1 [label="BTS"];
  BTS10 [label="BTS"];
  BTS11 [label="BTS"];
  BSC1 [label="BSC"];

  User -> CBC [label="proprietaty"];
  CBC -> BSC [label="CBSP"];
  CBC -> BSC1 [label="CBSP"];
  BSC -> BTS0 [label="RSL"];
  BSC -> BTS1 [label="RSL"];
  BSC1 -> BTS10 [label="RSL"];
  BSC1 -> BTS11 [label="RSL"];
  BTS0 -> MS [label="CBCH"];
}
----

== Cell Broadcast in GSM

[mscgen]
----
include::smscb-2g.msc[]
----

== Cell Broadcast in Osmocom today

image::osmocom-cbs.png[]

== Cell Broadcast in Osmocom soon (TM)

* publicly funded project to complete Cell Broadcast support
** Prototype Fund
* to be completed within Q3/2019
* covers at least the full support for 2G + 3G
** if time permits, 4G support will be added

== Functionality in the BTS

* replace one SDCCH in SDCCH/4 or SDCCH/8 with CBCH
* advertise CBCH presence in BCCH (SYSTEM INFORMATION)
* receive `RSL SMS BROADCAST CMD` from BSC
** segment that message into four blocks
** transmit blocks in `04.12 SMS BROADCAST REQ` on CBCH
* generate `CBCH LOAD INDICATION` and send them via RSL to BSC

== Functionality in the BSC

* receive SMSCB via CBSP from CBC
* distribute them to the respective BTSs in the target area
* schedule the bandwidth between different concurrently active SMSCB
* process RSL `CBCH LOAD INDICATION` and compute load averages
* perform flow control based on `RSL CBCH LOAD IND` from each BTS
* respond to load status enquiries from CBC

== Functionality in the CBC

* receive SMSCB from external users (emergency services)
** each SMSCB has geographic scope and validity period
** no standard interface specified in 3GPP
* manage distribution of SMSCB for each connected BSC
** send SMSCB only to those BSC within geographic scope
** remove messages from BSCs after time expires
** handle BSC restart situations where state is lost

== RSL SMS BROADCAST CMD

* transmits entire SMSCB message (88 octets)
* can also be used to set a _default SMSCB message_ 
** this message is transmitted whenever no other non-default message is pending
** works similar to _SACCH filling_ or _BCCH information_

== CBSP (3GPP TS 48.049)

* spoken on the unnamed interface between CBC and BSC
* no formal syntax, good old "human readable tables in specs" style
* transported over TCP port 48049
* key procedures
** Write-Replace Procedure
** Kill Procedure
** Load Status Enquiry Procedure
** Message Status Query Procedure
** Set DRX Procedure (optional)
** Reset Procedure

== Cell Broadcast in UMTS

Is actually called *Service Area Broadcast*

[graphviz]
----
digraph G {
  BTS0 [label="NodeB"];
  BTS1 [label="NodeB"];
  BTS10 [label="NodeB"];
  BTS11 [label="NodeB"];
  BSC [label="RNC"];
  BSC1 [label="RNC"];

  User -> CBC [label="proprietaty"];
  CBC -> BSC [label="SABP"];
  CBC -> BSC1 [label="SABP"];
  BSC -> BTS0 [label="Iub"];
  BSC -> BTS1 [label="Iub"];
  BSC1 -> BTS10 [label="Iub"];
  BSC1 -> BTS11 [label="Iub"];
  BTS0 -> UE [label="BMC/CTCH"];
}
----

== Cell Broadcast in UMTS

[mscgen]
----
include::smscb-3g.msc[]
----

== Functionality in the NodeB

* completely transparent
* relay the BMC protocol between UE (via Uu) and RNC (via Iub)

== Functionality in the RNC

* pretty much analogous to that of BSC
* schedule transmission of CBS messages on CTCH (Common Traffic Channel)

== Functionality in the CBC

* identical functionality like for 2G
* additional protocol required: SABP

== SABP Protocol (3GPP TS 25.419)

* spoken on Iu-BC interface between CBC and RNC
* specified in ASN.1 using BASIC-PER
* transported over ALCAP/SAAL/AAL5/ATM (yikes!)
** later specified over TCP port 3452
** some hints that use over UDP and SCTP also exists
** typiclaly established in CBC -> RNC direction 
* key procedures
** Write-Replace Procedure
** Kill Procedure
** Load Status Query Procedure
** Reset Procedure


== Functionality in the HNBGW

* hNodeBs include the RNC functionality, but they don't connect directly to CBC
* HNBGW handle the IuBC connection to the CBC
* relay / multiplex IuBC between hNodeBs and CBC


== Cell Broadcast in LTE

* Generic Cell Broadcast was removed; only Emergency Warnings in 4G
[graphviz]
----
digraph G {
  BTS0 [label="eNodeB"];
  BTS1 [label="eNodeB"];
  BTS10 [label="eNodeB"];
  BTS11 [label="eNodeB"];
  BSC [label="MME"];
  BSC1 [label="MME"];

  User -> CBC [label="proprietaty"];
  CBC -> BSC [label="SBc-AP"];
  CBC -> BSC1 [label="SBc-AP"];
  BSC -> BTS0 [label="S1-AP"];
  BSC -> BTS1 [label="S1-AP"];
  BSC1 -> BTS10 [label="S1-AP"];
  BSC1 -> BTS11 [label="S1-AP"];
  BTS0 -> UE [label="FIXME"];
}
----

== Cell Broadcast in LTE

[mscgen]
----
include::smscb-4g.msc[]
----

== Functionality in the eNodeB

* handling of S1-AP "Write-Replace Warning" procedure
* scheduling of SMSCB
* transmission of SMSCB in SIB

== Functionality in the MME

* pretty much analogous to that of BSC/RNC
* less work to do, as all scheduling is done inside eNodeB
* basically purely a distribution/routing function

== Functionality in the CBC

* identical functionality like for 2G/3G
* additional protocol required: SBc-AP

== SBc-AP Protocol (3GPP TS 29.168)

* spoken on SBc interface between CBC and MME
* ASN.1 specified
* operated over SCTP port 29168
* key procedures
** Write-Replace Warning Procedure
** Stop Warning Procedure
** Error Indication Procedure

== Wireshark support for Cell Broadcast

* `gsm_cbs` dissector for TS 04.12 format of SMSCB messages
* SABP dissector in mainline for more than a decade
* SBc-AP dissector present in mainline since 2011
* CBSP dissector missing
** written by Harald Welte in 2018, but untested and not yet mainline
** see `laforge/cbsp` branch of `git://git.osmocom.org/wireshark.git`

== Further Reading

* https://osmocom.org/projects/cellular-infrastructure/wiki/Cell_Broadcast[Cell Broadcast in Osmocom.org wiki]

* https://www.etsi.org/deliver/etsi_ts/123000_123099/123041/15.02.00_60/ts_123041v150200p.pdf[3GPP TS 23.041 GSM: Technical realization of Cell Broadcast Service (CBS)]
* https://www.etsi.org/deliver/etsi_ts/148000_148099/148049/15.00.00_60/ts_148049v150000p.pdf[3GPP TS 48.049 GSM: Baste Station Controller - Cell Broadcast Centre (BSC-CBC) interface specification; Cell Broadcast Service Protocol]
* http://www.etsi.org/deliver/etsi_ts/122200_122299/122268/14.00.00_60/ts_122268v140000p.pdf[3GPP TS 22.268 PWS: Public Warning System (PWS) requirements]
* https://www.etsi.org/deliver/etsi_ts/144000_144099/144012/15.00.00_60/ts_144012v150000p.pdf[3GPP TS 44.012 GSM: Short Message Service Cell Broadcast (SMSCB) support on the mobile radio interface]
* https://www.one2many.eu/assets/files/19_displaying-cb-messages.pdf[Whitepaper on Displaying Cell Broadcast]


== EOF

End of File
personal git repositories of Harald Welte. Your mileage may vary