osmodevcon2019: cell broadcast slides

5 files changed, 321 insertions, 0 deletions

diff --git a/2019/osmodevcon2019-cell_broadcast/osmocom-cbs.png b/2019/osmodevcon2019-cell_broadcast/osmocom-cbs.png
new file mode 100644
index 0000000..f42f472
--- /dev/null
+++ b/2019/osmodevcon2019-cell_broadcast/osmocom-cbs.png
diff --git a/2019/osmodevcon2019-cell_broadcast/osmodevcon2019-cell_broadcast.adoc b/2019/osmodevcon2019-cell_broadcast/osmodevcon2019-cell_broadcast.adoc
new file mode 100644
index 0000000..3089585
--- /dev/null
+++ b/2019/osmodevcon2019-cell_broadcast/osmodevcon2019-cell_broadcast.adoc
@@ -0,0 +1,265 @@
+Cell Broadcast for Osmocom
+==========================
+:author:	Harald Welte <laforge@gnumonks.org>
+:copyright:	2019 by Harald Welte (License: CC-BY-SA)
+:backend:	slidy
+:max-width:	45em
+
+
+== Cell Broadcast
+
+* classic GSM (and other 3GPP) are point-to-point
+** limited radio resources means limited concurrent communication
+* exotic options for point-to-multipoint
+** VGCS/VBS (voice group/broadcast calls) exist only in GSM-R
+** MBMS (never deployed in 2G/3G) adds multicast packet service
+* this leaves cell broadcast as the *only* fast way to send informations to many subscribers at once
+** main use case: emergency / disaster warning
+
+== Message Structure
+
+* Message has maximum 15 pages
+* Each page is 82 bytes of data, resulting in 93 characters in GSM 7-bit default alphabet
+* Messges are broadcast on logical channels (more like an address)
+* Subscribers can activate/deactivate selective addresses
+* 3GPP TS 03.41 / 23.041
+
+== Cell Broadcast in GSM
+
+[graphviz]
+----
+digraph G {
+  BTS0 [label="BTS"];
+  BTS1 [label="BTS"];
+  BTS10 [label="BTS"];
+  BTS11 [label="BTS"];
+  BSC1 [label="BSC"];
+
+  User -> CBC [label="proprietaty"];
+  CBC -> BSC [label="CBSP"];
+  CBC -> BSC1 [label="CBSP"];
+  BSC -> BTS0 [label="RSL"];
+  BSC -> BTS1 [label="RSL"];
+  BSC1 -> BTS10 [label="RSL"];
+  BSC1 -> BTS11 [label="RSL"];
+  BTS0 -> MS [label="CBCH"];
+}
+----
+
+== Cell Broadcast in GSM
+
+[mscgen]
+----
+include::smscb-2g.msc[]
+----
+
+== Cell Broadcast in Osmocom today
+
+image::osmocom-cbs.png[]
+
+== Cell Broadcast in Osmocom soon (TM)
+
+* publicly funded project to complete Cell Broadcast support
+** Prototype Fund
+* to be completed within Q3/2019
+* covers at least the full support for 2G + 3G
+** if time permits, 4G support will be added
+
+== Functionality in the BTS
+
+* replace one SDCCH in SDCCH/4 or SDCCH/8 with CBCH
+* advertise CBCH presence in BCCH (SYSTEM INFORMATION)
+* receive `RSL SMS BROADCAST CMD` from BSC
+** segment that message into four blocks
+** transmit blocks in `04.12 SMS BROADCAST REQ` on CBCH
+* generate `CBCH LOAD INDICATION` and send them via RSL to BSC
+
+== Functionality in the BSC
+
+* receive SMSCB via CBSP from CBC
+* distribute them to the respective BTSs in the target area
+* schedule the bandwidth between different concurrently active SMSCB
+* process RSL `CBCH LOAD INDICATION` and compute load averages
+* perform flow control based on `RSL CBCH LOAD IND` from each BTS
+* respond to load status enquiries from CBC
+
+== Functionality in the CBC
+
+* receive SMSCB from external users (emergency services)
+** each SMSCB has geographic scope and validity period
+** no standard interface specified in 3GPP
+* manage distribution of SMSCB for each connected BSC
+** send SMSCB only to those BSC within geographic scope
+** remove messages from BSCs after time expires
+** handle BSC restart situations where state is lost
+
+== RSL SMS BROADCAST CMD
+
+* transmits entire SMSCB message (88 octets)
+* can also be used to set a _default SMSCB message_ 
+** this message is transmitted whenever no other non-default message is pending
+** works similar to _SACCH filling_ or _BCCH information_
+
+== CBSP (3GPP TS 48.049)
+
+* spoken on the unnamed interface between CBC and BSC
+* no formal syntax, good old "human readable tables in specs" style
+* transported over TCP port 48049
+* key procedures
+** Write-Replace Procedure
+** Kill Procedure
+** Load Status Enquiry Procedure
+** Message Status Query Procedure
+** Set DRX Procedure (optional)
+** Reset Procedure
+
+== Cell Broadcast in UMTS
+
+Is actually called *Service Area Broadcast*
+
+[graphviz]
+----
+digraph G {
+  BTS0 [label="NodeB"];
+  BTS1 [label="NodeB"];
+  BTS10 [label="NodeB"];
+  BTS11 [label="NodeB"];
+  BSC [label="RNC"];
+  BSC1 [label="RNC"];
+
+  User -> CBC [label="proprietaty"];
+  CBC -> BSC [label="SABP"];
+  CBC -> BSC1 [label="SABP"];
+  BSC -> BTS0 [label="Iub"];
+  BSC -> BTS1 [label="Iub"];
+  BSC1 -> BTS10 [label="Iub"];
+  BSC1 -> BTS11 [label="Iub"];
+  BTS0 -> UE [label="BMC/CTCH"];
+}
+----
+
+== Cell Broadcast in UMTS
+
+[mscgen]
+----
+include::smscb-3g.msc[]
+----
+
+== Functionality in the NodeB
+
+* completely transparent
+* relay the BMC protocol between UE (via Uu) and RNC (via Iub)
+
+== Functionality in the RNC
+
+* pretty much analogous to that of BSC
+* schedule transmission of CBS messages on CTCH (Common Traffic Channel)
+
+== Functionality in the CBC
+
+* identical functionality like for 2G
+* additional protocol required: SABP
+
+== SABP Protocol (3GPP TS 25.419)
+
+* spoken on Iu-BC interface between CBC and RNC
+* specified in ASN.1 using BASIC-PER
+* transported over ALCAP/SAAL/AAL5/ATM (yikes!)
+** later specified over TCP port 3452
+** some hints that use over UDP and SCTP also exists
+** typiclaly established in CBC -> RNC direction 
+* key procedures
+** Write-Replace Procedure
+** Kill Procedure
+** Load Status Query Procedure
+** Reset Procedure
+
+
+== Functionality in the HNBGW
+
+* hNodeBs include the RNC functionality, but they don't connect directly to CBC
+* HNBGW handle the IuBC connection to the CBC
+* relay / multiplex IuBC between hNodeBs and CBC
+
+
+== Cell Broadcast in LTE
+
+* Generic Cell Broadcast was removed; only Emergency Warnings in 4G
+[graphviz]
+----
+digraph G {
+  BTS0 [label="eNodeB"];
+  BTS1 [label="eNodeB"];
+  BTS10 [label="eNodeB"];
+  BTS11 [label="eNodeB"];
+  BSC [label="MME"];
+  BSC1 [label="MME"];
+
+  User -> CBC [label="proprietaty"];
+  CBC -> BSC [label="SBc-AP"];
+  CBC -> BSC1 [label="SBc-AP"];
+  BSC -> BTS0 [label="S1-AP"];
+  BSC -> BTS1 [label="S1-AP"];
+  BSC1 -> BTS10 [label="S1-AP"];
+  BSC1 -> BTS11 [label="S1-AP"];
+  BTS0 -> UE [label="FIXME"];
+}
+----
+
+== Cell Broadcast in LTE
+
+[mscgen]
+----
+include::smscb-4g.msc[]
+----
+
+== Functionality in the eNodeB
+
+* handling of S1-AP "Write-Replace Warning" procedure
+* scheduling of SMSCB
+* transmission of SMSCB in SIB
+
+== Functionality in the MME
+
+* pretty much analogous to that of BSC/RNC
+* less work to do, as all scheduling is done inside eNodeB
+* basically purely a distribution/routing function
+
+== Functionality in the CBC
+
+* identical functionality like for 2G/3G
+* additional protocol required: SBc-AP
+
+== SBc-AP Protocol (3GPP TS 29.168)
+
+* spoken on SBc interface between CBC and MME
+* ASN.1 specified
+* operated over SCTP port 29168
+* key procedures
+** Write-Replace Warning Procedure
+** Stop Warning Procedure
+** Error Indication Procedure
+
+== Wireshark support for Cell Broadcast
+
+* `gsm_cbs` dissector for TS 04.12 format of SMSCB messages
+* SABP dissector in mainline for more than a decade
+* SBc-AP dissector present in mainline since 2011
+* CBSP dissector missing
+** written by Harald Welte in 2018, but untested and not yet mainline
+** see `laforge/cbsp` branch of `git://git.osmocom.org/wireshark.git`
+
+== Further Reading
+
+* https://osmocom.org/projects/cellular-infrastructure/wiki/Cell_Broadcast[Cell Broadcast in Osmocom.org wiki]
+
+* https://www.etsi.org/deliver/etsi_ts/123000_123099/123041/15.02.00_60/ts_123041v150200p.pdf[3GPP TS 23.041 GSM: Technical realization of Cell Broadcast Service (CBS)]
+* https://www.etsi.org/deliver/etsi_ts/148000_148099/148049/15.00.00_60/ts_148049v150000p.pdf[3GPP TS 48.049 GSM: Baste Station Controller - Cell Broadcast Centre (BSC-CBC) interface specification; Cell Broadcast Service Protocol]
+* http://www.etsi.org/deliver/etsi_ts/122200_122299/122268/14.00.00_60/ts_122268v140000p.pdf[3GPP TS 22.268 PWS: Public Warning System (PWS) requirements]
+* https://www.etsi.org/deliver/etsi_ts/144000_144099/144012/15.00.00_60/ts_144012v150000p.pdf[3GPP TS 44.012 GSM: Short Message Service Cell Broadcast (SMSCB) support on the mobile radio interface]
+* https://www.one2many.eu/assets/files/19_displaying-cb-messages.pdf[Whitepaper on Displaying Cell Broadcast]
+
+
+== EOF
+
+End of File
diff --git a/2019/osmodevcon2019-cell_broadcast/smscb-2g.msc b/2019/osmodevcon2019-cell_broadcast/smscb-2g.msc
new file mode 100644
index 0000000..c15175f
--- /dev/null
+++ b/2019/osmodevcon2019-cell_broadcast/smscb-2g.msc
@@ -0,0 +1,23 @@
+msc {
+	hscale="2";
+	ms [label="MS"], bts [label="BTS"], bsc [label="BSC"], cbc [label="CBC"], cbe [label="CBE"];
+
+	cbc <= cbe [label="New message (duration, geographic scope)"];
+
+	cbc box cbc [label="Determine list of BSCs in scope"];
+	bsc <= cbc [label="CBSP WRITE-REPLACE"];
+	bsc => cbc [label="CBSP WRITE-REPLACE ACK"];
+
+	bsc box bsc [label="Determine list of BTSs in scope"];
+	bsc box bsc [label="Schedule with any other SMSCB for give BTSs"];
+	bts <= bsc [label="RSL SMSCB COMMAND"];
+
+	ms <= bts [label="CBCH SMSCB block (1/4)"];
+	ms <= bts [label="CBCH SMSCB block (2/4)"];
+	ms <= bts [label="CBCH SMSCB block (3/4)"];
+	ms <= bts [label="CBCH SMSCB block (4/4)"];
+	bts box bts [label="BTS doesn't retransmit unless type=default"];
+
+	bts => bsc [label="RSL CBCH LOAD IND"];
+	bsc box bsc [label="flow control; scheduling"];
+}
diff --git a/2019/osmodevcon2019-cell_broadcast/smscb-3g.msc b/2019/osmodevcon2019-cell_broadcast/smscb-3g.msc
new file mode 100644
index 0000000..1dd058a
--- /dev/null
+++ b/2019/osmodevcon2019-cell_broadcast/smscb-3g.msc
@@ -0,0 +1,17 @@
+msc {
+	hscale="2";
+	ue [label="UE"], nodeb [label="NodeB"], rnc [label="RNC"], cbc [label="CBC"], cbe [label="CBE"];
+
+	cbc <= cbe [label="New message (duration, geographic scope)"];
+
+	cbc box cbc [label="Determine list of RNCs in scope"];
+	rnc <= cbc [label="SABP WRITE-REPLACE"];
+	rnc => cbc [label="SABP WRITE-REPLACE ACK"];
+
+	rnc box rnc [label="Determine list of NodeBs in scope"];
+	rnc box rnc [label="Schedule with any other SMSCB for give NodeBs"];
+
+	nodeb <= rnc [label="CTCH RRC CBS"];
+	ue <= nodeb [label="CTCH RRC CBS"];
+	rnc box rnc [label="flow control; scheduling"];
+}
diff --git a/2019/osmodevcon2019-cell_broadcast/smscb-4g.msc b/2019/osmodevcon2019-cell_broadcast/smscb-4g.msc
new file mode 100644
index 0000000..2e0ef2a
--- /dev/null
+++ b/2019/osmodevcon2019-cell_broadcast/smscb-4g.msc
@@ -0,0 +1,16 @@
+msc {
+	hscale="2";
+	ue [label="eUE"], nodeb [label="eNodeB"], mme [label="MME"], cbc [label="CBC"], cbe [label="CBE"];
+
+	cbc <= cbe [label="New message (duration, geographic scope)"];
+
+	cbc box cbc [label="Determine list of MMEs in scope"];
+	mme <= cbc [label="SBc-AP WRITE-REPLACE WARNING MSG"];
+
+	mme box mme [label="Determine list of eNodeBs in scope"];
+	nodeb <= mme [label="S1-AP Write-Replace Warning Req"];
+	nodeb => mme [label="S1-AP Write-Replace Warning Resp"];
+	mme => cbc [label="SBc-AP Write-Replace Warning Ind"];
+
+	ue <= nodeb [label="SIB Warning"];
+}