Unit 9: Mobile Networks




                          Advanced Security and Mobile Networks   W.Buchanan (1)
GSM/3G Technology
                             The most important mobile network
Unit 9: Mobile Networks




             ...
• First generation (1G). First generation
                             mobile phones (1G) had very low
                   ...
POTS
                             POTS
                          (Plain Old
                           (Plain Old
        ...
If we wish to setup
                              1           radio transmitters
                                         ...
Mobile device will
                              1           continually scan for other
                                  ...
GSM uses a mixture
                                                                          Of TDMA (Time-Division
      ...
Time slot
                                                    62.5 ms




                                                ...
24.8 MHz

                                        1          2                                  124             GSM-900
  ...
GSM-900
                                                                                                  GSM-900
        ...
More than one slot can be                           High-Speed Circuit
                                          reserved ...
General Packet Radio
                                                                                            General P...
Mobile Phone Cells/Masts
                             There’s one near you! Hopefully
Unit 9: Mobile Networks




        ...
From a uni-directional mast the
                                                           radio power radiates outwards, ...
Orange/Hutchison




                          T-Mobile
                          mast
Unit 9: Mobile Networks




       ...
Operator             Vodafone
                                           Operator Site Ref.   221
                        ...
Orange mast




O2
mast
Unit 9: Mobile Networks




                          Glenlockhart Hill (near
                    ...
Operator             MMO2
                          Operator Site Ref.   16853
                          Antenna Height   ...
Unit 9: Mobile Networks




                                                               Tynecastle Stadium offers a
   ...
Operator             Vodafone
                                                           Operator Site Ref.   31301
      ...
3G Mast on Blackford Avenue

                                                             3G antenna
                     ...
3G Mast on Comiston Road
                                                                     Pico cell

                 ...
Operator              Hutchison
                          Operator Site Ref.    EH0076
                          Antenna H...
Cell Name    Greenbank
                                                              CSR          016853
                 ...
Cell name:Murrayfield
                                                              CSR:       009182
                    ...
Mobile-phone based
                          Location Services
                             The next big thing?
Unit 9: Mo...
Tracking         Emergency
                          government       service     Tracking
                          emplo...
Curlup-n-Dye


                            Cupa-Now?

                                                                    ...
Parking
                                                           Travel costs
                          Road Tolls
Unit ...
•   GPS (Global Positioning System),
                           •   Cell-ID (Cell Identity),
                           • ...
Handset                         Network

                                                  Assistance
                    ...
Many accurate location
                                                                finding services are based
        ...
(6,8)                (14,8)
Unit 9: Mobile Networks




                                                            For ex...
(6,8)                        (14,8)


                                          5            5
                           ...
Triangulation
Unit 9: Mobile Networks




                                                        It is extremely accurate...
Mast
Unit 9: Mobile Networks




                                                 Mast
                                   ...
The accuracy depends
                                                          on the density of mast.

                  ...
Signal strength
                                             is measured against
                                         ...
Mast
Unit 9: Mobile Networks




                                                Mast
                                    ...
Unit 9: Mobile Networks




                                                   Measurement of
                            ...
Unit 9: Mobile Networks




                           A-GPS is also a time-based technique in which the handset measures
...
TOA works by the handset bouncing a signal back off the base stations,
                                                  o...
Mobile-phone based
                          Location Experiment
                           Borders, Scotland?
Unit 9: Mob...
Name:     Ancrum
                          ID:       002747
                          Type:     900 MACRO

               ...
The radio interface in GSM uses a combination between frequency (FDMA) and time
                            (TDMA) multipl...
Example of
                                                       masts in the
                                           ...
Conclusions
                           After the success of SMS, the network providers are looking
                       ...
Upcoming SlideShare
Loading in …5
×

Advanced Security and Mobile Networks

869 views

Published on

Published in: Business, Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
869
On SlideShare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
17
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Advanced Security and Mobile Networks

  1. 1. Unit 9: Mobile Networks Advanced Security and Mobile Networks W.Buchanan (1)
  2. 2. GSM/3G Technology The most important mobile network Unit 9: Mobile Networks Software Security W.Buchanan (2)
  3. 3. • First generation (1G). First generation mobile phones (1G) had very low transmission rates (typically just a few KB/s), • Second generation (2G and 2.5G). These are devices improved this to give several hundred KB/s. • Third generation (3G). These devices Unit 9: Mobile Networks give almost workstation network bandwidths (several MBps), which allows for full multimedia transmissions. Mobile phone technology W.Buchanan (3)
  4. 4. POTS POTS (Plain Old (Plain Old Telephone Telephone System) System) GSM GSM network network Unit 9: Mobile Networks GSM GSM gateway gateway Internet W.Buchanan (4)
  5. 5. If we wish to setup 1 radio transmitters how many different radio frequencies do 2 2 we need? 3 3 1 1 Unit 9: Mobile Networks 2 2 3 3 1 W.Buchanan (5)
  6. 6. Mobile device will 1 continually scan for other frequencies, even when it connects to one (in this 2 2 case, frequency 3). Sometimes there must 3 3 be a handover between two cells, if a user moves from one to another, and 1 1 is still in a call. Unit 9: Mobile Networks 2 2 3 3 1 W.Buchanan (6)
  7. 7. GSM uses a mixture Of TDMA (Time-Division 3G - 1.9-2.1GHz Multiple Access) and FDMA GSM-1800 (Frequency-Division Multiple (1.8GHz, non-US) Access) Known as DCS TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 Control Call 3 Call 1 GSM-900 (900MHz) GSM-1900 Channel 1 500ms (1.9GHz, US) Known as PCS TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 Unit 9: Mobile Networks Control Call 2 Dual-band phones Channel 2 02 - GSM-900, GSM-1800 TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 T-Mobile: GSM-1800 Control Call 4 Orange: GSM-900 Vodaphone: GSM-900, GSM-1800 3: UMTS (3G) Network Channel 3.. 124 (for GSM-900) Sitefinder: W.Buchanan (7)
  8. 8. Time slot 62.5 ms Speech burst is compressed and inserted Call 1 into the time slot Unit 9: Mobile Networks Mobile phone networks use RPE/LTP (Regular Pulse Excitation/ Long Term Prediction) - which reduces the normal rate from 64kbps to between 7 and 13 kbps. W.Buchanan (8)
  9. 9. 24.8 MHz 1 2 124 GSM-900 GSM-900 (900MHz) (900MHz) 200 kHz TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 Control Call 3 Call 1 Control Call 3 Call 1 Unit 9: Mobile Networks A specific timeslot is reserved for the call Call 1 on a specific channel Call 1 MUX DEMUX Call 3 Call 3 W.Buchanan (9)
  10. 10. GSM-900 GSM-900 (900MHz) (900MHz) Each time slot allows 9.6kbps TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 Control Call 3 Call 1 Control Call 3 Call 1 Unit 9: Mobile Networks A specific timeslot is reserved for the call Call 1 on a specific channel Call 1 MUX DEMUX Call 3 Call 3 W.Buchanan (10)
  11. 11. More than one slot can be High-Speed Circuit reserved (such as 38.4kbps for High-Speed Circuit Switched Data (HSCSD) Switched Data (HSCSD) 4 slots) TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 Control Call 1 Control Call 3 Call 1 Unit 9: Mobile Networks A specific timeslot is reserved for the call Call 1 on a specific channel Call 1 MUX DEMUX Call 3 Call 3 W.Buchanan (11)
  12. 12. General Packet Radio General Packet Radio Up to 8 time slots can be reserved Switch (GPRS) - -uses for the data packets (~100kbps) Switch (GPRS) uses Packet switching rather Packet switching rather than Circuit switching than Circuit switching TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 Control Control Call 3 Call 1 Unit 9: Mobile Networks A specific timeslot is reserved for the call Call 1 on a specific channel Call 1 MUX DEMUX Call 3 Call 3 W.Buchanan (12)
  13. 13. Mobile Phone Cells/Masts There’s one near you! Hopefully Unit 9: Mobile Networks Software Security W.Buchanan (13)
  14. 14. From a uni-directional mast the radio power radiates outwards, evenly Unit 9: Mobile Networks Power transmitted is typically defined in dbW: 20dBW is 100 W 25dbW is 316 W 30dBW is 1kW (Power of a microwave oven) Power Transmitted W.Buchanan (14)
  15. 15. Orange/Hutchison T-Mobile mast Unit 9: Mobile Networks Blackford Hill in Edinburgh is an excellent area for radio communications. Antenna Mast on Blackford Hill W.Buchanan (15)
  16. 16. Operator Vodafone Operator Site Ref. 221 Antenna Height 22 m Frequency 900 MHz Transmitter Power 24.68 dBW Maximum power 32 dBW Type GSM Operator Hutchison Operator Site Ref. EH0071 Antenna Height 23 m Frequency 2100 MHz Transmitter Power 25.5 dBW Unit 9: Mobile Networks Maximum power 32 dBW Type UMTS Operator T-MOBILE Operator Site Ref. 97636 Antenna Height 30 m Frequency 1800 MHz 20dBW is 100 W Transmitter Power 26 dBW 30dBW is 1kW Maximum power 32 dBW Type GSM W.Buchanan (16)
  17. 17. Orange mast O2 mast Unit 9: Mobile Networks Glenlockhart Hill (near Craiglockhart Campus) in Edinburgh is also another excellent area for radio communications. W.Buchanan (17)
  18. 18. Operator MMO2 Operator Site Ref. 16853 Antenna Height 23 m Frequency 900 MHz Transmitter Power 20 dBW Maximum power 32 dBW Type GSM Operator Orange Unit 9: Mobile Networks Operator Site Ref. LOT0106 Antenna Height 25 m Frequency 1800 MHz Transmitter Power 23.7 dBW Maximum power 32 dBW Type GSM W.Buchanan (18)
  19. 19. Unit 9: Mobile Networks Tynecastle Stadium offers a local high-point around Gorgie. Antenna Mast at Tynecastle Stadium W.Buchanan (19)
  20. 20. Operator Vodafone Operator Site Ref. 31301 Antenna Height 29 m Frequency 900 MHz Transmitter Power 24.15 dBW Maximum power 32 dBW Type GSM Operator Orange Operator Site Ref. LOT0053 Antenna Height 32 m Frequency 1800 MHz Transmitter Power 22.5 dBW Maximum power 32 dBW Type GSM Unit 9: Mobile Networks Operator Hutchison Operator Site Ref. EH0009 Antenna Height 28 m Frequency 2100 MHz Transmitter Power 26.2 dBW Maximum power 32 dBW Type UMTS Antenna Mast at Tynecastle Stadium W.Buchanan (20)
  21. 21. 3G Mast on Blackford Avenue 3G antenna Pico cell Operator Hutchison Operator Site Ref. EH0074 Antenna Height 13 m Frequency 2100 MHz Transmitter Power 26.2 dBW Maximum power 32 dBW Type UMTS Unit 9: Mobile Networks Operator MMO2 Operator Site Ref. 11578 Antenna Height 22 m Frequency 900 MHz Transmitter Power 25 dBW Maximum licensed power 32 dBW Type GSM Power supply and electronics 3G antenna on Blackford Avenue W.Buchanan (21)
  22. 22. 3G Mast on Comiston Road Pico cell Operator Hutchison Operator Site Ref. EH0073 Antenna Height 11 m Frequency 2100 MHz Transmitter Power 26.2 dBW Maximum power 32 dBW Type UMTS 3G antenna Unit 9: Mobile Networks Power supply and electronics 3G antenna on Comiston Road W.Buchanan (22)
  23. 23. Operator Hutchison Operator Site Ref. EH0076 Antenna Height 13 m Frequency 2100 MHz Transmitter Power 26.2 dBW Maximum power 32 dBW Type UMTS Unit 9: Mobile Networks W.Buchanan (23)
  24. 24. Cell Name Greenbank CSR 016853 Type 900 MACRO Cell Name: Edinburgh Dalry CSR: 017947 Type: 900 MACRO Cell Name: Murrayfield Stadium CSR: 005966 Typ: 900 PICO Cell name: Morningside North CSR: 015493 Unit 9: Mobile Networks Type: 900 MACRO Cell name: Merchiston South CSR: 011586 Type: 900 MACRO Cell name: Gorgie East CSR: 018669 Type: 900 MACRO Ref:http://www.webmap.o2.co.uk/ MM O2 network around Edinburgh W.Buchanan (24)
  25. 25. Cell name:Murrayfield CSR: 009182 Cell type: 900 MACRO 1800 MACRO Cell name: Blackford Unit 9: Mobile Networks Hill CSR: 011578 Cell type: 900 MACRO 1800 MACRO Ref:http://www.webmap.o2.co.uk/ MM O2 network around Edinburgh W.Buchanan (25)
  26. 26. Mobile-phone based Location Services The next big thing? Unit 9: Mobile Networks Software Security W.Buchanan (26)
  27. 27. Tracking Emergency government service Tracking employees tracking Service Personnel Inventory tracking Unit 9: Mobile Networks Location-tracking Transport services tracking Location-tracking services W.Buchanan (27)
  28. 28. Curlup-n-Dye Cupa-Now? Computer-Hack You need a When not try a new Haircut! wireless card? Unit 9: Mobile Networks Thirsty? Buy A nice latté Location-based advertising These technologies are based on ‘push’ services where information is pushed to the user, rather than them requesting it. Location-based Advertising W.Buchanan (28)
  29. 29. Parking Travel costs Road Tolls Unit 9: Mobile Networks Location-based sales Location-based Sales W.Buchanan (29)
  30. 30. • GPS (Global Positioning System), • Cell-ID (Cell Identity), • AOA (Angle of Arrival), • TOA (Time-of-arrival), • OTD (Observed Time Difference), • A-GPS (Assisted – Global Positioning System), • E-OTD (Enhanced - Observed Time Difference). Unit 9: Mobile Networks Methods used for Location-finding in Mobile Phones W.Buchanan (30)
  31. 31. Handset Network Assistance Position Calc Function Handset-based mode Position (x,y) Position (x,y) Assistance Unit 9: Mobile Networks Handset-assisted mode Measurement Position Calc Function Position (x,y) Handset-based or Handset-assisted W.Buchanan (31)
  32. 32. Many accurate location finding services are based on triangulation I am r1 away from a1, b1 I am r2 away from a2, b2 r1 I am r3 away from a3, b3 a2,b2 By drawing circles, we a1,b1 r2 can find the position Unit 9: Mobile Networks a3,b3 r3 Triangulation W.Buchanan (32)
  33. 33. (6,8) (14,8) Unit 9: Mobile Networks For example… if I am 5 metres away from each of these points. (10,0) Where am I? Triangulation W.Buchanan (33)
  34. 34. (6,8) (14,8) 5 5 3 4 Unit 9: Mobile Networks 5 This point should be (10,5) (10,0) Triangulation W.Buchanan (34)
  35. 35. Triangulation Unit 9: Mobile Networks It is extremely accurate, but it also has limited coverage in urban areas, especially within buildings or near obstructions. As an alternative, mobile phone-based location-finding is an inexpensive method for location-finding, as it has wide-scale coverage, along with inexpensive handsets Global Positioning System (GPS) W.Buchanan (35)
  36. 36. Mast Unit 9: Mobile Networks Mast cells Mast-based determines nearest mast Cell-ID (with omni-directional cells) W.Buchanan (36)
  37. 37. The accuracy depends on the density of mast. •From a few metres •To many km’s in rural areas. Unit 9: Mobile Networks Around Edinburgh the accuracy would be reasonable, in the Borders, not so good. Cell-ID (with sectored cells) W.Buchanan (37)
  38. 38. Signal strength is measured against a known propagation Unit 9: Mobile Networks pattern Or The time taken for the signals to arrive are measured Enhanced Cell-ID W.Buchanan (38)
  39. 39. Mast Unit 9: Mobile Networks Mast cells Measurement of time delay TOA (Time of Arrival) W.Buchanan (39)
  40. 40. Unit 9: Mobile Networks Measurement of angle Angle-of-Arrival (AOA) W.Buchanan (40)
  41. 41. Unit 9: Mobile Networks A-GPS is also a time-based technique in which the handset measures the arrival time of signals transmitted from three or more GPS satellites. In general, the information decoded by the GPS receiver from the satellites is transmitted to the handset through the radio network, bringing improvements for the time-to-first-fix (which is the initial time for the first location measurement) and battery life – as the handset no longer needs to search for and decode the signals from each available satellite. Removing the need to decode the satellite signals also enables detection and TOA estimation, which allows it to provide position estimates under foliage, within cars, in most outside environments, and many indoor environments. Assisted-GPS (A-GPS) W.Buchanan (41)
  42. 42. TOA works by the handset bouncing a signal back off the base stations, or vice-versa. Since radio waves travel at the speed of light (c), the distance (d) between the handset and base station can be estimated from the transmission delay, that is, half the time delay between transmitting and receiving the signal. This, however, locates the handset as being on a circle with a radius d, with the base station at the centre of the circle. If the estimate is made from three base stations, there will be three circles that intersect at the handset, as shown in the figure. Unit 9: Mobile Networks TDOA technique is time-based and quite similar to TOA. It works by either measuring the relative arrival time in the handset of signals transmitted from three base stations at the same time; or measuring relative arrival time transmitted by the handset at three base stations. The difference of arrival time defines a hyperbola, with the loci at the two base stations. As three base stations are used, there are three sets of time differences which creates three hyperbolic equations that define a single solution. Time-of-Arrival (TOA)/Time Difference of Arrival (TDOA) W.Buchanan (42)
  43. 43. Mobile-phone based Location Experiment Borders, Scotland? Unit 9: Mobile Networks W.Buchanan (43)
  44. 44. Name: Ancrum ID: 002747 Type: 900 MACRO Name: Eildon ID: 008393 Type: 900 MACRO Name: Dalcove Unit 9: Mobile Networks ID: 004121 Type: 900 MACRO W.Buchanan (44)
  45. 45. The radio interface in GSM uses a combination between frequency (FDMA) and time (TDMA) multiplexing. The frequency division in GSM 900 allocates 125 frequencies in each direction for GSM. The basic parameters are: • Uplink frequencies are between 890 and 915MHz. • Downlink frequencies are between 935 and 960MHz. • Carrier frequencies are separated with 200 kHz on each side. These frequencies are allocated in pairs, so that each uplink/downlink pair is separated with exactly 45 MHz. Each of the carrier frequencies are divided into eight logical channels, using TDMA, and a TDMA frame contains one time-frame from each of the eight channels, and lasts 4.615 ms. • Time-frames from each channel lasts 0.577 ms. Unit 9: Mobile Networks • Total bit-rate for all eight channels is 270.833 kbps, whereas the bit-rate for each channel is 22.8 kbps. Experimental Details W.Buchanan (45)
  46. 46. Example of masts in the Scottish Borders. It can be seen that each mast is identified with a different Cell-ID. These Have a different Unit 9: Mobile Networks broadcast frequency and channel (BCCH). No two adjacent cells have the same BCCH. Practical Example of Cells W.Buchanan (46)
  47. 47. Conclusions After the success of SMS, the network providers are looking for another big revenue generator that does not require too much bandwidth. Location-services could provide this. The key things that must be overcome are: Unit 9: Mobile Networks - Accuracy. - Compatibility. - Security. Users must subscribe to the services, as they will not trusts ones which allow other users to track them without their knowledge. - Distrust. Currently many users distrust mobile phones. - Integration with applications. W.Buchanan (47)

×