osmodevcon2019: cell broadcast slides
This commit is contained in:
parent
abdb51f63b
commit
3120341481
Binary file not shown.
|
After Width: | Height: | Size: 23 KiB |
|
|
@ -0,0 +1,265 @@
|
|||
Cell Broadcast for Osmocom
|
||||
==========================
|
||||
:author: Harald Welte <laforge@gnumonks.org>
|
||||
:copyright: 2019 by Harald Welte (License: CC-BY-SA)
|
||||
:backend: slidy
|
||||
:max-width: 45em
|
||||
|
||||
|
||||
== Cell Broadcast
|
||||
|
||||
* classic GSM (and other 3GPP) are point-to-point
|
||||
** limited radio resources means limited concurrent communication
|
||||
* exotic options for point-to-multipoint
|
||||
** VGCS/VBS (voice group/broadcast calls) exist only in GSM-R
|
||||
** MBMS (never deployed in 2G/3G) adds multicast packet service
|
||||
* this leaves cell broadcast as the *only* fast way to send informations to many subscribers at once
|
||||
** main use case: emergency / disaster warning
|
||||
|
||||
== Message Structure
|
||||
|
||||
* Message has maximum 15 pages
|
||||
* Each page is 82 bytes of data, resulting in 93 characters in GSM 7-bit default alphabet
|
||||
* Messges are broadcast on logical channels (more like an address)
|
||||
* Subscribers can activate/deactivate selective addresses
|
||||
* 3GPP TS 03.41 / 23.041
|
||||
|
||||
== Cell Broadcast in GSM
|
||||
|
||||
[graphviz]
|
||||
----
|
||||
digraph G {
|
||||
BTS0 [label="BTS"];
|
||||
BTS1 [label="BTS"];
|
||||
BTS10 [label="BTS"];
|
||||
BTS11 [label="BTS"];
|
||||
BSC1 [label="BSC"];
|
||||
|
||||
User -> CBC [label="proprietaty"];
|
||||
CBC -> BSC [label="CBSP"];
|
||||
CBC -> BSC1 [label="CBSP"];
|
||||
BSC -> BTS0 [label="RSL"];
|
||||
BSC -> BTS1 [label="RSL"];
|
||||
BSC1 -> BTS10 [label="RSL"];
|
||||
BSC1 -> BTS11 [label="RSL"];
|
||||
BTS0 -> MS [label="CBCH"];
|
||||
}
|
||||
----
|
||||
|
||||
== Cell Broadcast in GSM
|
||||
|
||||
[mscgen]
|
||||
----
|
||||
include::smscb-2g.msc[]
|
||||
----
|
||||
|
||||
== Cell Broadcast in Osmocom today
|
||||
|
||||
image::osmocom-cbs.png[]
|
||||
|
||||
== Cell Broadcast in Osmocom soon (TM)
|
||||
|
||||
* publicly funded project to complete Cell Broadcast support
|
||||
** Prototype Fund
|
||||
* to be completed within Q3/2019
|
||||
* covers at least the full support for 2G + 3G
|
||||
** if time permits, 4G support will be added
|
||||
|
||||
== Functionality in the BTS
|
||||
|
||||
* replace one SDCCH in SDCCH/4 or SDCCH/8 with CBCH
|
||||
* advertise CBCH presence in BCCH (SYSTEM INFORMATION)
|
||||
* receive `RSL SMS BROADCAST CMD` from BSC
|
||||
** segment that message into four blocks
|
||||
** transmit blocks in `04.12 SMS BROADCAST REQ` on CBCH
|
||||
* generate `CBCH LOAD INDICATION` and send them via RSL to BSC
|
||||
|
||||
== Functionality in the BSC
|
||||
|
||||
* receive SMSCB via CBSP from CBC
|
||||
* distribute them to the respective BTSs in the target area
|
||||
* schedule the bandwidth between different concurrently active SMSCB
|
||||
* process RSL `CBCH LOAD INDICATION` and compute load averages
|
||||
* perform flow control based on `RSL CBCH LOAD IND` from each BTS
|
||||
* respond to load status enquiries from CBC
|
||||
|
||||
== Functionality in the CBC
|
||||
|
||||
* receive SMSCB from external users (emergency services)
|
||||
** each SMSCB has geographic scope and validity period
|
||||
** no standard interface specified in 3GPP
|
||||
* manage distribution of SMSCB for each connected BSC
|
||||
** send SMSCB only to those BSC within geographic scope
|
||||
** remove messages from BSCs after time expires
|
||||
** handle BSC restart situations where state is lost
|
||||
|
||||
== RSL SMS BROADCAST CMD
|
||||
|
||||
* transmits entire SMSCB message (88 octets)
|
||||
* can also be used to set a _default SMSCB message_
|
||||
** this message is transmitted whenever no other non-default message is pending
|
||||
** works similar to _SACCH filling_ or _BCCH information_
|
||||
|
||||
== CBSP (3GPP TS 48.049)
|
||||
|
||||
* spoken on the unnamed interface between CBC and BSC
|
||||
* no formal syntax, good old "human readable tables in specs" style
|
||||
* transported over TCP port 48049
|
||||
* key procedures
|
||||
** Write-Replace Procedure
|
||||
** Kill Procedure
|
||||
** Load Status Enquiry Procedure
|
||||
** Message Status Query Procedure
|
||||
** Set DRX Procedure (optional)
|
||||
** Reset Procedure
|
||||
|
||||
== Cell Broadcast in UMTS
|
||||
|
||||
Is actually called *Service Area Broadcast*
|
||||
|
||||
[graphviz]
|
||||
----
|
||||
digraph G {
|
||||
BTS0 [label="NodeB"];
|
||||
BTS1 [label="NodeB"];
|
||||
BTS10 [label="NodeB"];
|
||||
BTS11 [label="NodeB"];
|
||||
BSC [label="RNC"];
|
||||
BSC1 [label="RNC"];
|
||||
|
||||
User -> CBC [label="proprietaty"];
|
||||
CBC -> BSC [label="SABP"];
|
||||
CBC -> BSC1 [label="SABP"];
|
||||
BSC -> BTS0 [label="Iub"];
|
||||
BSC -> BTS1 [label="Iub"];
|
||||
BSC1 -> BTS10 [label="Iub"];
|
||||
BSC1 -> BTS11 [label="Iub"];
|
||||
BTS0 -> UE [label="BMC/CTCH"];
|
||||
}
|
||||
----
|
||||
|
||||
== Cell Broadcast in UMTS
|
||||
|
||||
[mscgen]
|
||||
----
|
||||
include::smscb-3g.msc[]
|
||||
----
|
||||
|
||||
== Functionality in the NodeB
|
||||
|
||||
* completely transparent
|
||||
* relay the BMC protocol between UE (via Uu) and RNC (via Iub)
|
||||
|
||||
== Functionality in the RNC
|
||||
|
||||
* pretty much analogous to that of BSC
|
||||
* schedule transmission of CBS messages on CTCH (Common Traffic Channel)
|
||||
|
||||
== Functionality in the CBC
|
||||
|
||||
* identical functionality like for 2G
|
||||
* additional protocol required: SABP
|
||||
|
||||
== SABP Protocol (3GPP TS 25.419)
|
||||
|
||||
* spoken on Iu-BC interface between CBC and RNC
|
||||
* specified in ASN.1 using BASIC-PER
|
||||
* transported over ALCAP/SAAL/AAL5/ATM (yikes!)
|
||||
** later specified over TCP port 3452
|
||||
** some hints that use over UDP and SCTP also exists
|
||||
** typiclaly established in CBC -> RNC direction
|
||||
* key procedures
|
||||
** Write-Replace Procedure
|
||||
** Kill Procedure
|
||||
** Load Status Query Procedure
|
||||
** Reset Procedure
|
||||
|
||||
|
||||
== Functionality in the HNBGW
|
||||
|
||||
* hNodeBs include the RNC functionality, but they don't connect directly to CBC
|
||||
* HNBGW handle the IuBC connection to the CBC
|
||||
* relay / multiplex IuBC between hNodeBs and CBC
|
||||
|
||||
|
||||
== Cell Broadcast in LTE
|
||||
|
||||
* Generic Cell Broadcast was removed; only Emergency Warnings in 4G
|
||||
[graphviz]
|
||||
----
|
||||
digraph G {
|
||||
BTS0 [label="eNodeB"];
|
||||
BTS1 [label="eNodeB"];
|
||||
BTS10 [label="eNodeB"];
|
||||
BTS11 [label="eNodeB"];
|
||||
BSC [label="MME"];
|
||||
BSC1 [label="MME"];
|
||||
|
||||
User -> CBC [label="proprietaty"];
|
||||
CBC -> BSC [label="SBc-AP"];
|
||||
CBC -> BSC1 [label="SBc-AP"];
|
||||
BSC -> BTS0 [label="S1-AP"];
|
||||
BSC -> BTS1 [label="S1-AP"];
|
||||
BSC1 -> BTS10 [label="S1-AP"];
|
||||
BSC1 -> BTS11 [label="S1-AP"];
|
||||
BTS0 -> UE [label="FIXME"];
|
||||
}
|
||||
----
|
||||
|
||||
== Cell Broadcast in LTE
|
||||
|
||||
[mscgen]
|
||||
----
|
||||
include::smscb-4g.msc[]
|
||||
----
|
||||
|
||||
== Functionality in the eNodeB
|
||||
|
||||
* handling of S1-AP "Write-Replace Warning" procedure
|
||||
* scheduling of SMSCB
|
||||
* transmission of SMSCB in SIB
|
||||
|
||||
== Functionality in the MME
|
||||
|
||||
* pretty much analogous to that of BSC/RNC
|
||||
* less work to do, as all scheduling is done inside eNodeB
|
||||
* basically purely a distribution/routing function
|
||||
|
||||
== Functionality in the CBC
|
||||
|
||||
* identical functionality like for 2G/3G
|
||||
* additional protocol required: SBc-AP
|
||||
|
||||
== SBc-AP Protocol (3GPP TS 29.168)
|
||||
|
||||
* spoken on SBc interface between CBC and MME
|
||||
* ASN.1 specified
|
||||
* operated over SCTP port 29168
|
||||
* key procedures
|
||||
** Write-Replace Warning Procedure
|
||||
** Stop Warning Procedure
|
||||
** Error Indication Procedure
|
||||
|
||||
== Wireshark support for Cell Broadcast
|
||||
|
||||
* `gsm_cbs` dissector for TS 04.12 format of SMSCB messages
|
||||
* SABP dissector in mainline for more than a decade
|
||||
* SBc-AP dissector present in mainline since 2011
|
||||
* CBSP dissector missing
|
||||
** written by Harald Welte in 2018, but untested and not yet mainline
|
||||
** see `laforge/cbsp` branch of `git://git.osmocom.org/wireshark.git`
|
||||
|
||||
== Further Reading
|
||||
|
||||
* https://osmocom.org/projects/cellular-infrastructure/wiki/Cell_Broadcast[Cell Broadcast in Osmocom.org wiki]
|
||||
|
||||
* https://www.etsi.org/deliver/etsi_ts/123000_123099/123041/15.02.00_60/ts_123041v150200p.pdf[3GPP TS 23.041 GSM: Technical realization of Cell Broadcast Service (CBS)]
|
||||
* https://www.etsi.org/deliver/etsi_ts/148000_148099/148049/15.00.00_60/ts_148049v150000p.pdf[3GPP TS 48.049 GSM: Baste Station Controller - Cell Broadcast Centre (BSC-CBC) interface specification; Cell Broadcast Service Protocol]
|
||||
* http://www.etsi.org/deliver/etsi_ts/122200_122299/122268/14.00.00_60/ts_122268v140000p.pdf[3GPP TS 22.268 PWS: Public Warning System (PWS) requirements]
|
||||
* https://www.etsi.org/deliver/etsi_ts/144000_144099/144012/15.00.00_60/ts_144012v150000p.pdf[3GPP TS 44.012 GSM: Short Message Service Cell Broadcast (SMSCB) support on the mobile radio interface]
|
||||
* https://www.one2many.eu/assets/files/19_displaying-cb-messages.pdf[Whitepaper on Displaying Cell Broadcast]
|
||||
|
||||
|
||||
== EOF
|
||||
|
||||
End of File
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
msc {
|
||||
hscale="2";
|
||||
ms [label="MS"], bts [label="BTS"], bsc [label="BSC"], cbc [label="CBC"], cbe [label="CBE"];
|
||||
|
||||
cbc <= cbe [label="New message (duration, geographic scope)"];
|
||||
|
||||
cbc box cbc [label="Determine list of BSCs in scope"];
|
||||
bsc <= cbc [label="CBSP WRITE-REPLACE"];
|
||||
bsc => cbc [label="CBSP WRITE-REPLACE ACK"];
|
||||
|
||||
bsc box bsc [label="Determine list of BTSs in scope"];
|
||||
bsc box bsc [label="Schedule with any other SMSCB for give BTSs"];
|
||||
bts <= bsc [label="RSL SMSCB COMMAND"];
|
||||
|
||||
ms <= bts [label="CBCH SMSCB block (1/4)"];
|
||||
ms <= bts [label="CBCH SMSCB block (2/4)"];
|
||||
ms <= bts [label="CBCH SMSCB block (3/4)"];
|
||||
ms <= bts [label="CBCH SMSCB block (4/4)"];
|
||||
bts box bts [label="BTS doesn't retransmit unless type=default"];
|
||||
|
||||
bts => bsc [label="RSL CBCH LOAD IND"];
|
||||
bsc box bsc [label="flow control; scheduling"];
|
||||
}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
msc {
|
||||
hscale="2";
|
||||
ue [label="UE"], nodeb [label="NodeB"], rnc [label="RNC"], cbc [label="CBC"], cbe [label="CBE"];
|
||||
|
||||
cbc <= cbe [label="New message (duration, geographic scope)"];
|
||||
|
||||
cbc box cbc [label="Determine list of RNCs in scope"];
|
||||
rnc <= cbc [label="SABP WRITE-REPLACE"];
|
||||
rnc => cbc [label="SABP WRITE-REPLACE ACK"];
|
||||
|
||||
rnc box rnc [label="Determine list of NodeBs in scope"];
|
||||
rnc box rnc [label="Schedule with any other SMSCB for give NodeBs"];
|
||||
|
||||
nodeb <= rnc [label="CTCH RRC CBS"];
|
||||
ue <= nodeb [label="CTCH RRC CBS"];
|
||||
rnc box rnc [label="flow control; scheduling"];
|
||||
}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
msc {
|
||||
hscale="2";
|
||||
ue [label="eUE"], nodeb [label="eNodeB"], mme [label="MME"], cbc [label="CBC"], cbe [label="CBE"];
|
||||
|
||||
cbc <= cbe [label="New message (duration, geographic scope)"];
|
||||
|
||||
cbc box cbc [label="Determine list of MMEs in scope"];
|
||||
mme <= cbc [label="SBc-AP WRITE-REPLACE WARNING MSG"];
|
||||
|
||||
mme box mme [label="Determine list of eNodeBs in scope"];
|
||||
nodeb <= mme [label="S1-AP Write-Replace Warning Req"];
|
||||
nodeb => mme [label="S1-AP Write-Replace Warning Resp"];
|
||||
mme => cbc [label="SBc-AP Write-Replace Warning Ind"];
|
||||
|
||||
ue <= nodeb [label="SIB Warning"];
|
||||
}
|
||||
Loading…
Reference in New Issue