Speaker: Michael Iedema "OpenBTS implements a complete GSM stack for voice and SMS. It also supports GPRS and UMTS 3G data standards. With an off-the-shelf server and SDR (software defined radio), it is now possible to build real mobile networks. These networks can be used to support true fixed-mobile convergence, bring coverage to remote areas or just experiment and innovate within the cellular network itself. Because OpenBTS converts all cellular signalling and media directly to SIP and RTP, the development environment should be familiar!" ElastixWorld Santiago de Chile October 2014

1. OpenBTS.org
Building Cellular Networks - Big or Small
Michael Iedema | @iedemam

2. OpenBTS.org
• what is OpenBTS
• GSM and SDR crash course
• converting between GSM andVoIP
• software and signaling support
• single tower to multi-tower
• APIs
• looking ahead

3. OpenBTS.org
What is OpenBTS

4. OpenBTS.org
OpenBTS
is a transparent Open Source gateway between cellular handsets andVoIP networks

5. OpenBTS.org
OpenBTS
implements cellular radio interface standards in C++ and runs in userspace

6. OpenBTS.org
OpenBTS
uses SDR (software defined radio) hardware instead of proprietary equipment

7. OpenBTS.org
OpenBTS turns this...
Abis
BTSBTSBSC
A
BSC
VLR
MSCMSCHLR
SS7-MAP
AuC
Radio
BH
GMSC
Nc
SGSN
Gb
GGSN
IP
InternetPSTN
Gn
Home Location Register
Authentication Center
Mobile Switching Center
Visitor Location Register
Gateway Mobile Switching Center
Base Station Controller
Serving GPRS Support Node
Gateway GPRS Support Node
Base Transceiver Station
Modem
Handset

8. OpenBTS.org
...into this
Radio
PSTN ITSP Internet
IP
SIP/RTP
OpenBTSOpenBTS
SIP/RTP
Modem
Handset
Central Services
SIP REGISTER
SIP INVITE
SIP MESSAGE

9. OpenBTS.org
GSM voice and SMS
supported cellular radio standards

10. OpenBTS.org
GPRS 2G data
supported cellular radio standards

11. OpenBTS.org
UMTS 3G data
supported cellular radio standards

12. OpenBTS.org
LTE (coming next year)
supported cellular radio standards

14. OpenBTS.org
GSM and SDR Crash Course

15. OpenBTS.org
Overall Hierarchy
tower, sector,ARFCN, downlink/uplink, timeslot, logical channel, frame, burst

16. OpenBTS.org
towers can have multiple sectors

17. OpenBTS.org
sectors can have multiple ARFCNs
Absolute Radio Frequency Channel Numbers, also known as “carriers”

18. OpenBTS.org
each ARFCN has two frequencies
one for downlink and one for uplink, spaced by a specific offset

19. OpenBTS.org
downlink/uplink have 8 timeslots
GSM is both FDMA and TDMA

20. OpenBTS.org
timeslots have multiple logical channels
assigned in “combinations”

21. OpenBTS.org
logical channels are made of frames

22. OpenBTS.org
frames are made of bursts

23. OpenBTS.org
time for a visualizer
downlink, uplink, timeslots and combinations

24. OpenBTS.org
openbts.org/visualizer

26. OpenBTS.org
Logical Channels - Broadcast
FCH, SCH, BCCH, CCCH, RACH

27. OpenBTS.org
FCH - Frequency Correction Channel
calibrates handset radio

28. OpenBTS.org
SCH - Synchronization Channel
calibrates handset scheduler

29. OpenBTS.org
BCCH - Broadcast Control Channel
sends network identity and capability information

30. OpenBTS.org
CCCH - Common Control Channel
allows network to page handsets

31. OpenBTS.org
RACH - Random Access Channel
allows handsets to page network

33. OpenBTS.org
Logical Channels - Dedicated
SDCCH,TCH

34. OpenBTS.org
SDCCH - Standalone Dedicated Control Channel
signaling traffic

35. OpenBTS.org
TCH - Traffic Channel
media traffic

36. OpenBTS.org
time for another visualizer!
timeslots and dedicated logical channels

38. OpenBTS.org
Operations
LUR, MOC, MTC, EmergencyCall, MOSMS, MTSMS

39. OpenBTS.org
LUR - Location Update Request
handset registration with optional authentication

40. OpenBTS.org
MOC - Mobile Originated Call

41. OpenBTS.org
MTC - Mobile Terminated Call

42. OpenBTS.org
EmergencyCall
totally cool

43. OpenBTS.org
MOSMS - Mobile Originated SMS

44. OpenBTS.org
MTSMS - Mobile Terminated SMS

46. OpenBTS.org
SDRs
Software Defined Radios

47. OpenBTS.org
completely generic radio
SDRs

48. OpenBTS.org
all logic is in software
SDRs

49. OpenBTS.org
differentiated by sensitivity...
SDRs

50. OpenBTS.org
...frequency range...
SDRs

51. OpenBTS.org
...and megasamples (bandwidth)
SDRs

52. OpenBTS.org
monitor for: $25 radio + SDRSharp
http://www.rtl-sdr.com

54. OpenBTS.org
multiple concurrent logical radios
SDRs

55. OpenBTS.org
GSM to UMTS is a software upgrade
SDRs

57. OpenBTS.org
Converting Between GSM andVoIP

58. OpenBTS.org
MOC, MTC = SIP INVITE

59. SIP Switch OpenBTS Handset
IMMED. ASSIGN.
CHAN. REQ.
RTP traffic GSM traffic
CM SVC. REQ.
CM SVC. ACCEPT
SETUP
INVITE CALL PROCEEDING
Status: 182 Ringing
ALERTING
Status: 200 OK
CONNECT
CONNECT ACK.
Status: 100 Trying

60. SIP Switch OpenBTS Handset
IMMED. ASSIGN.
CHAN. REQ.
RTP traffic GSM traffic
CM SVC. REQ.
CM SVC. ACCEPT
SETUP
INVITE CALL PROCEEDING
Status: 182 Ringing
ALERTING
Status: 200 OK
CONNECT
CONNECT ACK.
Status: 100 Trying
RR
MM
CC

61. SIP Switch OpenBTS Handset
IMMED. ASSIGN.
CHAN. REQ.
RTP traffic GSM traffic
CM SVC. REQ.
CM SVC. ACCEPT
SETUP
INVITE CALL PROCEEDING
Status: 182 Ringing
ALERTING
Status: 200 OK
CONNECT
CONNECT ACK.
Status: 100 Trying
SIP Switch OpenBTS Handset
IMMED. ASSIGN.
CHAN. REQ.
RTP traffic GSM traffic
CM SVC. REQ.
CM SVC. ACCEPT
SETUP
INVITE CALL PROCEEDING
Status: 182 Ringing
ALERTING
Status: 200 OK
CONNECT
CONNECT ACK.
Status: 100 Trying

62. OpenBTS.org
MOSMS, MTSMS = SIP MESSAGE

63. OpenBTS.org
LUR = SIP REGISTER
both use digest style authentication, mapping to SIP is surprisingly easy

64. OpenBTS.org
LUR = SIP REGISTER
RAND = nonce | A3 = MD5 | SRES = response

65. OpenBTS.org
“algorithm=MD5”
RFC does not limit this algorithm, more choices needed in SIP software

68. OpenBTS.org
Software and Signaling Support

69. OpenBTS.org
Keep in Mind: GSM Network Arch
Abis
BTSBTSBSC
A
BSC
VLR
MSCMSCHLR
SS7-MAP
AuC
Radio
BH
GMSC
Nc
SGSN
Gb
GGSN
IP
InternetPSTN
Gn
Home Location Register
Authentication Center
Mobile Switching Center
Visitor Location Register
Gateway Mobile Switching Center
Base Station Controller
Serving GPRS Support Node
Gateway GPRS Support Node
Base Transceiver Station
Modem
Handset

70. OpenBTS.org
Original IP Architecture
tested and supported since project inception

71. OpenBTS.org
Radio
PSTN ITSP Internet
IP
SIP/RTP
OpenBTSOpenBTS
SIP/RTP
Modem
Handset
Central Services
SIPAuthServe
Asterisk
SMQueue
Original IP Architecture

72. OpenBTS.org
Kazoo Architecture
complete integration, no difference between a deskphone or a GSM handset

73. OpenBTS.org
Kazoo Architecture
Radio
PSTN ITSP Internet
IP
SIP/RTP
OpenBTSOpenBTS
Erlang
Modem
Handset
Kazoo
Authorization Server
Voice Switch
Message Queue
FreeSWITCH
SIP/RTP

74. OpenBTS.org
Direct Architecture
patches being written for Asterisk and FreeSWITCH

75. OpenBTS.org
Direct Architecture
adding A3 algorithm to SIP authentication is easy

76. OpenBTS.org
Direct Architecture
store-and-forward SIP MESSAGE support is still missing

77. OpenBTS.org
Direct Architecture
Radio
PSTN ITSP Internet
IP
SIP/RTP
OpenBTSOpenBTS
SIP/RTP
Modem
Handset
Central Services
Asterisk/FreeSWITCH

78. OpenBTS.org
Direct Architecture
install OpenBTS, point at existing PBX, done

79. OpenBTS.org
Direct Architecture
Askozia has a beta with these patches integrated

81. OpenBTS.org
Single Tower to Multi-Tower

82. OpenBTS.org
a “tower” is not a tower

83. OpenBTS.org
single tower
“network-in-a-box”

84. Mobile Station
Radio Hardware Transceiver Software
OpenBTS
Raw Samples over UDP
Raw Samples
Over USB or Ethernet
GSM Radio (Um)
Interface
SIPAuthServe
GSM LUR
SIP REGISTER
SMQueue
GSM SMS
SIP MESSAGE
Asterisk
GSM Voice
SIP INVITE
SIP and RTP over UDP

85. antenna alignment

86. In OutTx Rx
Amplifier
Tx Rx
DuplexerRadio
stronger cleaner signals

87. OpenBTS.org
multi-tower

88. Tower 1
Central Services
OpenBTS
SIPAuthServe
SIP REGISTER
SMQueue
SIP MESSAGE
Asterisk
SIP INVITE
SIP/RTPSIP/RTP
Tower 2
OpenBTS

89. OpenBTS.org
MCC, MNC, NCC
multi-tower - network identity

90. OpenBTS.org
LAC, CI, BCC
multi-tower - base station identity

91. ARFCN: 172
BCC: 4
ARFCN: 170
BCC: 3
ARFCN: 166
BCC: 1
ARFCN: 168
BCC: 2
ARFCN: 174
BCC: 5
ARFCN: 172
BCC: 4
ARFCN: 168
BCC: 2
ARFCN: 166
BCC: 1
ARFCN: 174
BCC: 5
ARFCN: 170
BCC: 3
ARFCN: 166
BCC: 1
ARFCN: 168
BCC: 2
ARFCN: 174
BCC: 5
ARFCN: 172
BCC: 4
ARFCN: 168
BCC: 2
ARFCN: 166
BCC: 1
ARFCN: 170
BCC: 3
50 m
100 mW

92. ARFCN: 172
BCC: 4
ARFCN: 170
BCC: 3
ARFCN: 166
BCC: 1
ARFCN: 168
BCC: 2
ARFCN: 174
BCC: 5
ARFCN: 172
BCC: 4
ARFCN: 168
BCC: 2
ARFCN: 166
BCC: 1
ARFCN: 174
BCC: 5
ARFCN: 170
BCC: 3
ARFCN: 166
BCC: 1
ARFCN: 168
BCC: 2
ARFCN: 174
BCC: 5
ARFCN: 172
BCC: 4
ARFCN: 168
BCC: 2
ARFCN: 166
BCC: 1
ARFCN: 170
BCC: 3
5 km
10 W

93. OpenBTS.org
multiple physical signals, one logical network

94. OpenBTS.org
Mobility, Handover and Roaming
non-interchangeable terms

95. OpenBTS.org
Mobility
when idle, handset decides which tower is best

96. OpenBTS.org
Handover
on an active call, network tells handset to change towers

97. OpenBTS.org
Roaming
mobility between different service providers

99. OpenBTS.org
APIs

100. OpenBTS.org
PhysicalStatus API

101. OpenBTS.org
{
"name" : "PhysicalStatus",
"timestamp" : "18446744072283447705",
"version" : "0.1",
"data" : {
"burst" : {
"RSSI" : -49.4808,
"RSSP" : -27.4808,
"actualMSPower" : 11,
"actualMSTimingAdvance" : 0,
"timingError" : 1.59709
},
"channel" : {
"ARFCN" : 153,
"IMSI" : "001010000000001",
"carrierNumber" : 0,
"timeslotNumber" : 0,
"typeAndOffset" : "SDCCH/4-1",
"uplinkFrameErrorRate" : 0
},
"reports" : {
"neighboringCells" : [],
"servingCell" : {
"RXLEVEL_FULL_dBm" : -67,
"RXLEVEL_SUB_dBm" : -67,
"RXQUALITY_FULL_BER" : 0,
"RXQUALITY_SUB_BER" : 0
}
}
}
}

102. OpenBTS.org
search and rescue
PhysicalStatus API

103. OpenBTS.org
traffic reports
PhysicalStatus API

104. OpenBTS.org
automatic site survey
PhysicalStatus API

105. OpenBTS.org
power modeling
PhysicalStatus API

106. OpenBTS.org
ARFCN visualizer
PhysicalStatus API

107. OpenBTS.org
IMSI visualizer
PhysicalStatus API

108. OpenBTS.org
other APIs
config, monitor, version, imsis, etc...

110. OpenBTS.org
Looking Ahead

111. OpenBTS.org
licensed frequency
the biggest problem at the moment

112. OpenBTS.org
licensed frequency
some European countries opening up public guard bands

113. OpenBTS.org
licensed frequency
other countries reallocating unused spectrum more granularly

114. OpenBTS.org
smartphones
lots of innovation

115. OpenBTS.org
“the cloud”
lots of innovation

116. OpenBTS.org
the cellular core network
stagnant

117. OpenBTS.org
it’s an IP world
love it or hate it

118. OpenBTS.org
it’s an IP world
but backwards compatibility is so cool, right?

119. OpenBTS.org
it’s an IP world
DTMF

120. OpenBTS.org
it’s an IP world
Fax

121. OpenBTS.org
it’s an IP world
cellular radio air interface protocols

123. OpenBTS.org
Questions
mriedema@gmail.com
twitter.com/iedemam
twitter.com/openbts
https://github.com/RangeNetworks/presentations/