Cell Broadcast for Osmocom ========================== :author: Harald Welte :copyright: 2019 by Harald Welte (License: CC-BY-SA) :backend: slidy :max-width: 45em == Cell Broadcast * classic GSM (and other 3GPP) are point-to-point ** limited radio resources means limited concurrent communication * exotic options for point-to-multipoint ** VGCS/VBS (voice group/broadcast calls) exist only in GSM-R ** MBMS (never deployed in 2G/3G) adds multicast packet service * this leaves cell broadcast as the *only* fast way to send informations to many subscribers at once ** main use case: emergency / disaster warning == Message Structure * Message has maximum 15 pages * Each page is 82 bytes of data, resulting in 93 characters in GSM 7-bit default alphabet * Messges are broadcast on logical channels (more like an address) * Subscribers can activate/deactivate selective addresses * 3GPP TS 03.41 / 23.041 == Cell Broadcast in GSM [graphviz] ---- digraph G { BTS0 [label="BTS"]; BTS1 [label="BTS"]; BTS10 [label="BTS"]; BTS11 [label="BTS"]; BSC1 [label="BSC"]; User -> CBC [label="proprietaty"]; CBC -> BSC [label="CBSP"]; CBC -> BSC1 [label="CBSP"]; BSC -> BTS0 [label="RSL"]; BSC -> BTS1 [label="RSL"]; BSC1 -> BTS10 [label="RSL"]; BSC1 -> BTS11 [label="RSL"]; BTS0 -> MS [label="CBCH"]; } ---- == Cell Broadcast in GSM [mscgen] ---- include::smscb-2g.msc[] ---- == Cell Broadcast in Osmocom today image::osmocom-cbs.png[] == Cell Broadcast in Osmocom soon (TM) * publicly funded project to complete Cell Broadcast support ** Prototype Fund * to be completed within Q3/2019 * covers at least the full support for 2G + 3G ** if time permits, 4G support will be added == Functionality in the BTS * replace one SDCCH in SDCCH/4 or SDCCH/8 with CBCH * advertise CBCH presence in BCCH (SYSTEM INFORMATION) * receive `RSL SMS BROADCAST CMD` from BSC ** segment that message into four blocks ** transmit blocks in `04.12 SMS BROADCAST REQ` on CBCH * generate `CBCH LOAD INDICATION` and send them via RSL to BSC == Functionality in the BSC * receive SMSCB via CBSP from CBC * distribute them to the respective BTSs in the target area * schedule the bandwidth between different concurrently active SMSCB * process RSL `CBCH LOAD INDICATION` and compute load averages * perform flow control based on `RSL CBCH LOAD IND` from each BTS * respond to load status enquiries from CBC == Functionality in the CBC * receive SMSCB from external users (emergency services) ** each SMSCB has geographic scope and validity period ** no standard interface specified in 3GPP * manage distribution of SMSCB for each connected BSC ** send SMSCB only to those BSC within geographic scope ** remove messages from BSCs after time expires ** handle BSC restart situations where state is lost == RSL SMS BROADCAST CMD * transmits entire SMSCB message (88 octets) * can also be used to set a _default SMSCB message_ ** this message is transmitted whenever no other non-default message is pending ** works similar to _SACCH filling_ or _BCCH information_ == CBSP (3GPP TS 48.049) * spoken on the unnamed interface between CBC and BSC * no formal syntax, good old "human readable tables in specs" style * transported over TCP port 48049 * key procedures ** Write-Replace Procedure ** Kill Procedure ** Load Status Enquiry Procedure ** Message Status Query Procedure ** Set DRX Procedure (optional) ** Reset Procedure == Cell Broadcast in UMTS Is actually called *Service Area Broadcast* [graphviz] ---- digraph G { BTS0 [label="NodeB"]; BTS1 [label="NodeB"]; BTS10 [label="NodeB"]; BTS11 [label="NodeB"]; BSC [label="RNC"]; BSC1 [label="RNC"]; User -> CBC [label="proprietaty"]; CBC -> BSC [label="SABP"]; CBC -> BSC1 [label="SABP"]; BSC -> BTS0 [label="Iub"]; BSC -> BTS1 [label="Iub"]; BSC1 -> BTS10 [label="Iub"]; BSC1 -> BTS11 [label="Iub"]; BTS0 -> UE [label="BMC/CTCH"]; } ---- == Cell Broadcast in UMTS [mscgen] ---- include::smscb-3g.msc[] ---- == Functionality in the NodeB * completely transparent * relay the BMC protocol between UE (via Uu) and RNC (via Iub) == Functionality in the RNC * pretty much analogous to that of BSC * schedule transmission of CBS messages on CTCH (Common Traffic Channel) == Functionality in the CBC * identical functionality like for 2G * additional protocol required: SABP == SABP Protocol (3GPP TS 25.419) * spoken on Iu-BC interface between CBC and RNC * specified in ASN.1 using BASIC-PER * transported over ALCAP/SAAL/AAL5/ATM (yikes!) ** later specified over TCP port 3452 ** some hints that use over UDP and SCTP also exists ** typiclaly established in CBC -> RNC direction * key procedures ** Write-Replace Procedure ** Kill Procedure ** Load Status Query Procedure ** Reset Procedure == Functionality in the HNBGW * hNodeBs include the RNC functionality, but they don't connect directly to CBC * HNBGW handle the IuBC connection to the CBC * relay / multiplex IuBC between hNodeBs and CBC == Cell Broadcast in LTE * Generic Cell Broadcast was removed; only Emergency Warnings in 4G [graphviz] ---- digraph G { BTS0 [label="eNodeB"]; BTS1 [label="eNodeB"]; BTS10 [label="eNodeB"]; BTS11 [label="eNodeB"]; BSC [label="MME"]; BSC1 [label="MME"]; User -> CBC [label="proprietaty"]; CBC -> BSC [label="SBc-AP"]; CBC -> BSC1 [label="SBc-AP"]; BSC -> BTS0 [label="S1-AP"]; BSC -> BTS1 [label="S1-AP"]; BSC1 -> BTS10 [label="S1-AP"]; BSC1 -> BTS11 [label="S1-AP"]; BTS0 -> UE [label="FIXME"]; } ---- == Cell Broadcast in LTE [mscgen] ---- include::smscb-4g.msc[] ---- == Functionality in the eNodeB * handling of S1-AP "Write-Replace Warning" procedure * scheduling of SMSCB * transmission of SMSCB in SIB == Functionality in the MME * pretty much analogous to that of BSC/RNC * less work to do, as all scheduling is done inside eNodeB * basically purely a distribution/routing function == Functionality in the CBC * identical functionality like for 2G/3G * additional protocol required: SBc-AP == SBc-AP Protocol (3GPP TS 29.168) * spoken on SBc interface between CBC and MME * ASN.1 specified * operated over SCTP port 29168 * key procedures ** Write-Replace Warning Procedure ** Stop Warning Procedure ** Error Indication Procedure == Wireshark support for Cell Broadcast * `gsm_cbs` dissector for TS 04.12 format of SMSCB messages * SABP dissector in mainline for more than a decade * SBc-AP dissector present in mainline since 2011 * CBSP dissector missing ** written by Harald Welte in 2018, but untested and not yet mainline ** see `laforge/cbsp` branch of `git://git.osmocom.org/wireshark.git` == Further Reading * https://osmocom.org/projects/cellular-infrastructure/wiki/Cell_Broadcast[Cell Broadcast in Osmocom.org wiki] * https://www.etsi.org/deliver/etsi_ts/123000_123099/123041/15.02.00_60/ts_123041v150200p.pdf[3GPP TS 23.041 GSM: Technical realization of Cell Broadcast Service (CBS)] * https://www.etsi.org/deliver/etsi_ts/148000_148099/148049/15.00.00_60/ts_148049v150000p.pdf[3GPP TS 48.049 GSM: Baste Station Controller - Cell Broadcast Centre (BSC-CBC) interface specification; Cell Broadcast Service Protocol] * http://www.etsi.org/deliver/etsi_ts/122200_122299/122268/14.00.00_60/ts_122268v140000p.pdf[3GPP TS 22.268 PWS: Public Warning System (PWS) requirements] * https://www.etsi.org/deliver/etsi_ts/144000_144099/144012/15.00.00_60/ts_144012v150000p.pdf[3GPP TS 44.012 GSM: Short Message Service Cell Broadcast (SMSCB) support on the mobile radio interface] * https://www.one2many.eu/assets/files/19_displaying-cb-messages.pdf[Whitepaper on Displaying Cell Broadcast] == EOF End of File