diff options
| -rw-r--r-- | 2019/osmodevcon2019-cell_broadcast/osmocom-cbs.png | bin | 0 -> 23904 bytes | |||
| -rw-r--r-- | 2019/osmodevcon2019-cell_broadcast/osmodevcon2019-cell_broadcast.adoc | 265 | ||||
| -rw-r--r-- | 2019/osmodevcon2019-cell_broadcast/smscb-2g.msc | 23 | ||||
| -rw-r--r-- | 2019/osmodevcon2019-cell_broadcast/smscb-3g.msc | 17 | ||||
| -rw-r--r-- | 2019/osmodevcon2019-cell_broadcast/smscb-4g.msc | 16 |
5 files changed, 321 insertions, 0 deletions
diff --git a/2019/osmodevcon2019-cell_broadcast/osmocom-cbs.png b/2019/osmodevcon2019-cell_broadcast/osmocom-cbs.png Binary files differnew file mode 100644 index 0000000..f42f472 --- /dev/null +++ b/2019/osmodevcon2019-cell_broadcast/osmocom-cbs.png diff --git a/2019/osmodevcon2019-cell_broadcast/osmodevcon2019-cell_broadcast.adoc b/2019/osmodevcon2019-cell_broadcast/osmodevcon2019-cell_broadcast.adoc new file mode 100644 index 0000000..3089585 --- /dev/null +++ b/2019/osmodevcon2019-cell_broadcast/osmodevcon2019-cell_broadcast.adoc @@ -0,0 +1,265 @@ +Cell Broadcast for Osmocom +========================== +:author: Harald Welte <laforge@gnumonks.org> +:copyright: 2019 by Harald Welte (License: CC-BY-SA) +:backend: slidy +:max-width: 45em + + +== Cell Broadcast + +* classic GSM (and other 3GPP) are point-to-point +** limited radio resources means limited concurrent communication +* exotic options for point-to-multipoint +** VGCS/VBS (voice group/broadcast calls) exist only in GSM-R +** MBMS (never deployed in 2G/3G) adds multicast packet service +* this leaves cell broadcast as the *only* fast way to send informations to many subscribers at once +** main use case: emergency / disaster warning + +== Message Structure + +* Message has maximum 15 pages +* Each page is 82 bytes of data, resulting in 93 characters in GSM 7-bit default alphabet +* Messges are broadcast on logical channels (more like an address) +* Subscribers can activate/deactivate selective addresses +* 3GPP TS 03.41 / 23.041 + +== Cell Broadcast in GSM + +[graphviz] +---- +digraph G { + BTS0 [label="BTS"]; + BTS1 [label="BTS"]; + BTS10 [label="BTS"]; + BTS11 [label="BTS"]; + BSC1 [label="BSC"]; + + User -> CBC [label="proprietaty"]; + CBC -> BSC [label="CBSP"]; + CBC -> BSC1 [label="CBSP"]; + BSC -> BTS0 [label="RSL"]; + BSC -> BTS1 [label="RSL"]; + BSC1 -> BTS10 [label="RSL"]; + BSC1 -> BTS11 [label="RSL"]; + BTS0 -> MS [label="CBCH"]; +} +---- + +== Cell Broadcast in GSM + +[mscgen] +---- +include::smscb-2g.msc[] +---- + +== Cell Broadcast in Osmocom today + +image::osmocom-cbs.png[] + +== Cell Broadcast in Osmocom soon (TM) + +* publicly funded project to complete Cell Broadcast support +** Prototype Fund +* to be completed within Q3/2019 +* covers at least the full support for 2G + 3G +** if time permits, 4G support will be added + +== Functionality in the BTS + +* replace one SDCCH in SDCCH/4 or SDCCH/8 with CBCH +* advertise CBCH presence in BCCH (SYSTEM INFORMATION) +* receive `RSL SMS BROADCAST CMD` from BSC +** segment that message into four blocks +** transmit blocks in `04.12 SMS BROADCAST REQ` on CBCH +* generate `CBCH LOAD INDICATION` and send them via RSL to BSC + +== Functionality in the BSC + +* receive SMSCB via CBSP from CBC +* distribute them to the respective BTSs in the target area +* schedule the bandwidth between different concurrently active SMSCB +* process RSL `CBCH LOAD INDICATION` and compute load averages +* perform flow control based on `RSL CBCH LOAD IND` from each BTS +* respond to load status enquiries from CBC + +== Functionality in the CBC + +* receive SMSCB from external users (emergency services) +** each SMSCB has geographic scope and validity period +** no standard interface specified in 3GPP +* manage distribution of SMSCB for each connected BSC +** send SMSCB only to those BSC within geographic scope +** remove messages from BSCs after time expires +** handle BSC restart situations where state is lost + +== RSL SMS BROADCAST CMD + +* transmits entire SMSCB message (88 octets) +* can also be used to set a _default SMSCB message_ +** this message is transmitted whenever no other non-default message is pending +** works similar to _SACCH filling_ or _BCCH information_ + +== CBSP (3GPP TS 48.049) + +* spoken on the unnamed interface between CBC and BSC +* no formal syntax, good old "human readable tables in specs" style +* transported over TCP port 48049 +* key procedures +** Write-Replace Procedure +** Kill Procedure +** Load Status Enquiry Procedure +** Message Status Query Procedure +** Set DRX Procedure (optional) +** Reset Procedure + +== Cell Broadcast in UMTS + +Is actually called *Service Area Broadcast* + +[graphviz] +---- +digraph G { + BTS0 [label="NodeB"]; + BTS1 [label="NodeB"]; + BTS10 [label="NodeB"]; + BTS11 [label="NodeB"]; + BSC [label="RNC"]; + BSC1 [label="RNC"]; + + User -> CBC [label="proprietaty"]; + CBC -> BSC [label="SABP"]; + CBC -> BSC1 [label="SABP"]; + BSC -> BTS0 [label="Iub"]; + BSC -> BTS1 [label="Iub"]; + BSC1 -> BTS10 [label="Iub"]; + BSC1 -> BTS11 [label="Iub"]; + BTS0 -> UE [label="BMC/CTCH"]; +} +---- + +== Cell Broadcast in UMTS + +[mscgen] +---- +include::smscb-3g.msc[] +---- + +== Functionality in the NodeB + +* completely transparent +* relay the BMC protocol between UE (via Uu) and RNC (via Iub) + +== Functionality in the RNC + +* pretty much analogous to that of BSC +* schedule transmission of CBS messages on CTCH (Common Traffic Channel) + +== Functionality in the CBC + +* identical functionality like for 2G +* additional protocol required: SABP + +== SABP Protocol (3GPP TS 25.419) + +* spoken on Iu-BC interface between CBC and RNC +* specified in ASN.1 using BASIC-PER +* transported over ALCAP/SAAL/AAL5/ATM (yikes!) +** later specified over TCP port 3452 +** some hints that use over UDP and SCTP also exists +** typiclaly established in CBC -> RNC direction +* key procedures +** Write-Replace Procedure +** Kill Procedure +** Load Status Query Procedure +** Reset Procedure + + +== Functionality in the HNBGW + +* hNodeBs include the RNC functionality, but they don't connect directly to CBC +* HNBGW handle the IuBC connection to the CBC +* relay / multiplex IuBC between hNodeBs and CBC + + +== Cell Broadcast in LTE + +* Generic Cell Broadcast was removed; only Emergency Warnings in 4G +[graphviz] +---- +digraph G { + BTS0 [label="eNodeB"]; + BTS1 [label="eNodeB"]; + BTS10 [label="eNodeB"]; + BTS11 [label="eNodeB"]; + BSC [label="MME"]; + BSC1 [label="MME"]; + + User -> CBC [label="proprietaty"]; + CBC -> BSC [label="SBc-AP"]; + CBC -> BSC1 [label="SBc-AP"]; + BSC -> BTS0 [label="S1-AP"]; + BSC -> BTS1 [label="S1-AP"]; + BSC1 -> BTS10 [label="S1-AP"]; + BSC1 -> BTS11 [label="S1-AP"]; + BTS0 -> UE [label="FIXME"]; +} +---- + +== Cell Broadcast in LTE + +[mscgen] +---- +include::smscb-4g.msc[] +---- + +== Functionality in the eNodeB + +* handling of S1-AP "Write-Replace Warning" procedure +* scheduling of SMSCB +* transmission of SMSCB in SIB + +== Functionality in the MME + +* pretty much analogous to that of BSC/RNC +* less work to do, as all scheduling is done inside eNodeB +* basically purely a distribution/routing function + +== Functionality in the CBC + +* identical functionality like for 2G/3G +* additional protocol required: SBc-AP + +== SBc-AP Protocol (3GPP TS 29.168) + +* spoken on SBc interface between CBC and MME +* ASN.1 specified +* operated over SCTP port 29168 +* key procedures +** Write-Replace Warning Procedure +** Stop Warning Procedure +** Error Indication Procedure + +== Wireshark support for Cell Broadcast + +* `gsm_cbs` dissector for TS 04.12 format of SMSCB messages +* SABP dissector in mainline for more than a decade +* SBc-AP dissector present in mainline since 2011 +* CBSP dissector missing +** written by Harald Welte in 2018, but untested and not yet mainline +** see `laforge/cbsp` branch of `git://git.osmocom.org/wireshark.git` + +== Further Reading + +* https://osmocom.org/projects/cellular-infrastructure/wiki/Cell_Broadcast[Cell Broadcast in Osmocom.org wiki] + +* https://www.etsi.org/deliver/etsi_ts/123000_123099/123041/15.02.00_60/ts_123041v150200p.pdf[3GPP TS 23.041 GSM: Technical realization of Cell Broadcast Service (CBS)] +* https://www.etsi.org/deliver/etsi_ts/148000_148099/148049/15.00.00_60/ts_148049v150000p.pdf[3GPP TS 48.049 GSM: Baste Station Controller - Cell Broadcast Centre (BSC-CBC) interface specification; Cell Broadcast Service Protocol] +* http://www.etsi.org/deliver/etsi_ts/122200_122299/122268/14.00.00_60/ts_122268v140000p.pdf[3GPP TS 22.268 PWS: Public Warning System (PWS) requirements] +* https://www.etsi.org/deliver/etsi_ts/144000_144099/144012/15.00.00_60/ts_144012v150000p.pdf[3GPP TS 44.012 GSM: Short Message Service Cell Broadcast (SMSCB) support on the mobile radio interface] +* https://www.one2many.eu/assets/files/19_displaying-cb-messages.pdf[Whitepaper on Displaying Cell Broadcast] + + +== EOF + +End of File diff --git a/2019/osmodevcon2019-cell_broadcast/smscb-2g.msc b/2019/osmodevcon2019-cell_broadcast/smscb-2g.msc new file mode 100644 index 0000000..c15175f --- /dev/null +++ b/2019/osmodevcon2019-cell_broadcast/smscb-2g.msc @@ -0,0 +1,23 @@ +msc { + hscale="2"; + ms [label="MS"], bts [label="BTS"], bsc [label="BSC"], cbc [label="CBC"], cbe [label="CBE"]; + + cbc <= cbe [label="New message (duration, geographic scope)"]; + + cbc box cbc [label="Determine list of BSCs in scope"]; + bsc <= cbc [label="CBSP WRITE-REPLACE"]; + bsc => cbc [label="CBSP WRITE-REPLACE ACK"]; + + bsc box bsc [label="Determine list of BTSs in scope"]; + bsc box bsc [label="Schedule with any other SMSCB for give BTSs"]; + bts <= bsc [label="RSL SMSCB COMMAND"]; + + ms <= bts [label="CBCH SMSCB block (1/4)"]; + ms <= bts [label="CBCH SMSCB block (2/4)"]; + ms <= bts [label="CBCH SMSCB block (3/4)"]; + ms <= bts [label="CBCH SMSCB block (4/4)"]; + bts box bts [label="BTS doesn't retransmit unless type=default"]; + + bts => bsc [label="RSL CBCH LOAD IND"]; + bsc box bsc [label="flow control; scheduling"]; +} diff --git a/2019/osmodevcon2019-cell_broadcast/smscb-3g.msc b/2019/osmodevcon2019-cell_broadcast/smscb-3g.msc new file mode 100644 index 0000000..1dd058a --- /dev/null +++ b/2019/osmodevcon2019-cell_broadcast/smscb-3g.msc @@ -0,0 +1,17 @@ +msc { + hscale="2"; + ue [label="UE"], nodeb [label="NodeB"], rnc [label="RNC"], cbc [label="CBC"], cbe [label="CBE"]; + + cbc <= cbe [label="New message (duration, geographic scope)"]; + + cbc box cbc [label="Determine list of RNCs in scope"]; + rnc <= cbc [label="SABP WRITE-REPLACE"]; + rnc => cbc [label="SABP WRITE-REPLACE ACK"]; + + rnc box rnc [label="Determine list of NodeBs in scope"]; + rnc box rnc [label="Schedule with any other SMSCB for give NodeBs"]; + + nodeb <= rnc [label="CTCH RRC CBS"]; + ue <= nodeb [label="CTCH RRC CBS"]; + rnc box rnc [label="flow control; scheduling"]; +} diff --git a/2019/osmodevcon2019-cell_broadcast/smscb-4g.msc b/2019/osmodevcon2019-cell_broadcast/smscb-4g.msc new file mode 100644 index 0000000..2e0ef2a --- /dev/null +++ b/2019/osmodevcon2019-cell_broadcast/smscb-4g.msc @@ -0,0 +1,16 @@ +msc { + hscale="2"; + ue [label="eUE"], nodeb [label="eNodeB"], mme [label="MME"], cbc [label="CBC"], cbe [label="CBE"]; + + cbc <= cbe [label="New message (duration, geographic scope)"]; + + cbc box cbc [label="Determine list of MMEs in scope"]; + mme <= cbc [label="SBc-AP WRITE-REPLACE WARNING MSG"]; + + mme box mme [label="Determine list of eNodeBs in scope"]; + nodeb <= mme [label="S1-AP Write-Replace Warning Req"]; + nodeb => mme [label="S1-AP Write-Replace Warning Resp"]; + mme => cbc [label="SBc-AP Write-Replace Warning Ind"]; + + ue <= nodeb [label="SIB Warning"]; +} |
