Running GSM mobile phone on SDR

Video in TIB AV-Portal: Running GSM mobile phone on SDR

Formal Metadata

Running GSM mobile phone on SDR
SDR PHY for OsmocomBB
Title of Series
CC Attribution 4.0 International:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Release Date

Content Metadata

Subject Area
Since SDR (Software Defined Radio) becomes more popular and more available for everyone, there is a lot of projects based on this technology. Looking from the mobile telecommunications side, at the moment it's possible to run your own GSM or UMTS network using a transmit capable SDR device and free software like OsmoBTS or OpenBTS. There is also the srsLTE project, which provides open source implementation of LTE base station (eNodeB) and moreover the client side stack (srsUE) for SDR. Our talk is about the R&D process of porting the existing GSM mobile side stack (OsmocomBB) to the SDR based hardware, and about the results we have achieved.
Keywords Hardware & Making

Related Material

The following resource is accompanying material for the video
Multiplication sign Computer hardware Moment <Mathematik> Software-defined radio Quicksort Software-defined radio
Multiplication Length Multiplication sign Demo (music) Projective plane Software-defined radio Sign (mathematics) Word Software Web-Designer Computer hardware Telecommunication Forest Order (biology) Authorization Computing platform Freeware Multiplication Data structure
Implementation System call Software developer Multiplication sign GSM-Software-Management AG Coprocessor Operator (mathematics) Software Energy level Software framework Communications protocol Physical system Form (programming) Moment (mathematics) Projective plane Open source Measurement Type theory Category of being Message passing Process (computing) Software Website Operating system Firmware
Implementation Digital signal processor Open source Student's t-test Black box Different (Kate Ryan album) Software Computer hardware Authorization Endliche Modelltheorie Communications protocol Implementation Information security Form (programming) Serial port Prisoner's dilemma Projective plane Open source Content (media) Interactive television Serial communication Computer network Limit (category theory) Leak Software Computer hardware MiniDisc Information security Reverse engineering Firmware
Pulse (signal processing) Touchscreen Keyboard shortcut Implementation Open source GSM-Software-Management AG Causality Different (Kate Ryan album) Software Computer hardware Ideal (ethics) Communications protocol Implementation Computing platform Form (programming) Physical system Covering space Boss Corporation Touchscreen Software developer Open source Software-defined radio Computer network Device driver Sign (mathematics) Process (computing) Software Computer hardware Computing platform Game theory Simulation Scheduling (computing) Communications protocol
Frame problem Serial port Game controller TDMA Multiplication sign Source code Serial communication Division (mathematics) Software-defined radio Control flow Cartesian coordinate system Code Software Personal digital assistant Software Mehrfachzugriff Damping Communications protocol Message passing Scheduling (computing) Communications protocol Computing platform Firmware
Cone penetration test Open source Mereology Protein Event horizon Human migration Synchronization Zeitsynchronisation Data structure Extension (kinesiology) Library (computing) Multiplication Metropolitan area network Task (computing) Projective plane Open source Control flow Cartesian coordinate system Flow separation Frame problem Kernel (computing) Network socket Table (information) Viterbi-Algorithmus Scheduling (computing) Communications protocol Data structure
Computer program Greatest element Group action Digital electronics Source code Execution unit Set (mathematics) Stress (mechanics) Virtual reality Endliche Modelltheorie UDP <Protokoll> Physical system Social class Source code Boss Corporation Mapping Software developer Multitier architecture Stress (mechanics) Parallel port Price index Control flow Category of being Type theory Digital rights management Interface (computing) Software testing Simulation Resultant Module (mathematics) Open source Distance Architecture Computer hardware Zeitsynchronisation Energy level Software testing Communications protocol Proxy server ASCII Capability Maturity Model Mobile Web Socket-Schnittstelle Serial port Interface (computing) Projective plane Computer network Core dump Software-defined radio Stack (abstract data type) Cartesian coordinate system Resource allocation Software Network socket Computer hardware Mixed reality Communications protocol
Implementation Direction (geometry) Multiplication sign GSM-Software-Management AG Set (mathematics) Mathematical analysis Function (mathematics) Inverse element Mereology Area Broadcasting (networking) Different (Kate Ryan album) Logic Queue (abstract data type) Cuboid Area Block (periodic table) Forcing (mathematics) Projective plane Counting Control flow Cartesian coordinate system Software Function (mathematics) Blog Synchronization Musical ensemble Block (periodic table)
Frame problem Building TDMA Multiplication sign Maxima and minima GSM-Software-Management AG Shift operator Number Medical imaging Mehrfachzugriff Position operator Task (computing) Module (mathematics) Shift operator Differential (mechanical device) Block (periodic table) Interface (computing) Software-defined radio Division (mathematics) Maxima and minima Data transmission Frame problem Interface (computing) Game theory Block (periodic table)
Ocean current Frame problem Implementation Algorithm Multiplication sign View (database) Sheaf (mathematics) Metadata Number Power (physics) Medical imaging Frequency Chain Mathematics Cross-correlation Cuboid Energy level Row (database) Data conversion Data structure Endliche Modelltheorie output Position operator Task (computing) Shift operator Information Key (cryptography) Closed set Moment (mathematics) Sampling (statistics) Interactive television Software-defined radio Lattice (order) Measurement Frame problem Signal processing Transmitter Type theory Particle system Digital signal processing Frequency Software Computer hardware Function (mathematics) Transmissionskoeffizient Figurate number
Logical constant Computer program Multiplication sign Workstation <Musikinstrument> Execution unit GSM-Software-Management AG Streaming media Data transmission Theory Frequency Thetafunktion Internet forum Hypermedia Task (computing) God Interface (computing) Computer program Sampling (statistics) Continuous function Data transmission Electric dipole moment Connected space Dean number Transmitter Quicksort Object (grammar)
Demon Spectrum (functional analysis) Digital filter Implementation Multiplication sign Content (media) Analogy Transmitter Transmitter Goodness of fit Process (computing) Type theory Sample (statistics) Personal digital assistant Function (mathematics) Chain Revision control Distortion (mathematics) Resultant Spectrum (functional analysis) Firmware
Software Open source Different (Kate Ryan album) Demo (music) Software-defined radio Cartesian coordinate system Capability Maturity Model
Presentation of a group Manufacturing execution system Hecke operator Local area network INTEGRAL Multiplication sign Demo (music) Workstation <Musikinstrument> GSM-Software-Management AG Bit rate Grass (card game) Area CNN Electronic meeting system Hash function Active contour model Extension (kinesiology) Scalable Coherent Interface Service (economics) Link (knot theory) Satellite Decimal Web page Moment (mathematics) Interior (topology) Mass Menu (computing) Hypothesis Annulus (mathematics) Message passing Uniform resource name Interface (computing) Convex hull Polygon mesh Empennage Digital filter Mobile app Implementation Cellular automaton Spyware Heat transfer RAID Number Finite element method Bridging (networking) Operator (mathematics) Telnet Execution unit Focus (optics) Twin prime Interface (computing) Computer network Cartesian coordinate system Sign (mathematics) Mathematics Error message Software Case modding Formal grammar Musical ensemble
Implementation Open source Codierung <Programmierung> Multiplication sign Demo (music) Bit rate Complete metric space Shape (magazine) Plastikkarte Computer font Measurement Frequency Internetworking Computer hardware Musical ensemble Implementation Loop (music) Computing platform Polar coordinate system Closed set Projective plane Open source Code Software-defined radio Computer network Line (geometry) Control flow Power (physics) Mathematics Sign (mathematics) Word Frequency Software Ring (mathematics) Computer hardware Order (biology) Interface (computing) Computing platform Simulation
Pauli exclusion principle Hypermedia System programming Median
so text
is the this is the time and the for so for the next talk for this evening this is the torque that is out of personally interesting to me and I hope to you as well I'm would very much looking forward to it are next to speakers are will be talking to us about how we can deploy GSM base stations Over software-defined radio hardware and so they're interesting things that will hear from them that so please a welcome Virginia needs sky and theater critic at big Ronald lositan and fj I think the more that actually so high everyone in this is sort of 1st token at the Congress so taste for having us here let's start and my name is what it means
camera researcher from positive to acknowledges company at that the communication department at the same time and I'm not a smoker and contributor I had some background in web development but this time is going and now I'm into the communications no I prefer to use C and by 10 in the spirit of however Krishak kind working can force so University of Technology I generally a person that thinks that free software using this authorities said goodbye idea and writing it is even better so I created some small pieces of free software myself and the 1 of them is due GSM I will introduce you to the length another 1 is multi eye on the other it's uh software forests and rising as the as the ah devices in order to make it from them multichamber receivers so the OK so that we are going to
introduce our work we have been doing for so long time and in a few words to show you how to run their use a more well formed on software-defined radio and as you probably already know our project is based on mostly based on a spoken be project so we will introduce it in a few words and we will tell you what you want is there currently supported out and white-collar work makes sense and finally we will show you some demonstrations yeah so let me ask co money people
here used to play the so spoken the pricier has please and not so much continuing headaches and so from my experience so when people hear about us what could be be they basically measurement of all Motorola phone of a Motorola phone risk always have gained from where so so what
is it and it's not a secret for everyone that you phone actually has supported Weizmann protease so that takes care about the network operation no matter which operating system do you prefer to use when you're sitting a short messages for calling calling to your friend your operating system kindly asks the 2nd baseman process to do that so the baseband processors type running in has some property FIL and has many other people we don't trust this framework the so that's could the main idea of BB project these 2 pro-whites and their open-source implementation of for 1 side stick of GSM and to the higher level so this take our that the become represented by a software running on your whole sites PC and to their lower layer is where 1 of is from work which is running on some Conitzer base form and to the implementation is more or less complete so you can make some ways called and 4 semesters and so 1 but at the same time this project is not actually maintained and the moment
so you might ask being why do any disk projects for for what for easy it's and well it depends on who you are if you're the student or just begin it later became your best friend in practical learning of GSM stack if you have some kind of security researcher hunting related Hinduism that aren't you probably already know about this project content and it explained here and of course it's mostly health to the back existing course work on projects of the and so on
there a few hours ago there were a few weeks of leaks all for TA can lead to a source called the documentation and these a Lotus Macomb researchers to reverse-engineer different world of examples Motorola phones and to me and so the primary how for spoken bebiese mostly model of a model calypso base forms mostly Motorola see 1 or something like that and so forth from their customs who where we share prisons layer 1 of 2 since they can these were interacts with the whole software via a serial link and most of the problem was that this show were not that doesn't do much of thinks it mostly derived separately authorities what so what was the problem what is the problem is that society however is not manufacturer tenure more mostly and say they teased is digital signaling protease there is lots of fully researched so used to relay on black box running an open source software and so fine and this is not full open-source implementation and so the the hardware and this limits you in some ways for example you cannot operate into appearance small by the hardware is capable to the left
so what happened if a tied to replace solar can it's a base form we something else for example what about software defined radio and what is also defined to it it
is a general purpose ideal hardly it's not limited to any particular technology or software stack and so this means that it could be used for different technologies and protocols like the held the caribou too so there's some kind of causes have yet to the some so here's the good news here is that this is open source friendly when you open source projects do support to smoke sorry has his job and so many is there and there's so to support this open source actually and of course the software defined radio a is popular in scope mobile communications so you come from your own LTE network for example or around your own use a network you can't even around built the mobile said prove steak but what about system we kinda on their mobile phone on GSM actually and hopes yeah this is actually in our work have games to play the so do you remember this is general-purpose hardware so there's no screen there is no OK boss there's scenery there for how dose system but in general we're not going to create another open-source use targeted form and so then you ask me what is it for and so mostly this inherits somewhere the I'm from most work on the project and as mentioned before it's mostly for education research and development in this pulse you to implement the absolutely open source where when Implementation and the souls have to have and yet another cover a platform for a spoken and yeah this
let's turn back time and some amazing that we are developing where software defines radio platform for a spoken be from scratch and so from what did you start
so here on the top of this picture because you can see there was what on application which was previously used to that connects to the higher low plications and the lower layer of represented by from work together and so they clarifications used to communicate via serial link but the in our case we don't have to worry anymore it don't have formed and we need to communicate with software-defined radio somehow so yeah after a quick look at the source code of for smoke BB we found that it's easy to use and the want control protocol is accustomed but pretty simple protocol and so would this is that these protocols is implemented in software of higher levels and intra 2 hands the problem is that it's not only the host applications to understand that layer to freeze but not to layer 1 bursts sold and you need to write implement some kind of bursting coding from here and so another problem is that the cost applications so don't care about time division multiple access and this is 1 of some basic technology into some so we need to implement some kind of two-dimentional here and those which is
became so a source of inspiration because both thinks already implemented here so we separated the common part of that was Mobutu's which is actually possible cone man base station project and we created separate Charlotte Charity protocol to tables according and cleanup and clean up and look amount some parts of court and extend that we saw accelerated reader read the code of and also we took some basic there some structures so I can which a frame structural clock synchronization proteins from uh was marketeers as these and finally now we have to Rex Kwon
applications and now we can communicate we use kernel applications but still we cannot communicate we saw for defines reader we can uh received URIs her task was performed in according and according to for them but we cannot directly communicated his software-defined trade events and there is some
serious protocol he she was 1st introduced in it is project and it's still used by us will be property as to communicate with transceiver and basically it assumes TDP circuits I 1 for resource management another for full of claims frame clock indications and has the for an action before goes and so what can we implemented these 2 into risk on applications and now as my boss was not only be impossible because projects do support units interface so we we connect them together to for a parallel development and testing without the actual hardware and yes of course we can do that stands so welcome face URIs toolkit is this a set of tools written in Python and mostly used for at the bottom tier at interface and the most interesting application curious feature X it works and it allows you to connect to use come directly to possible BTS application it acts like a proxy on their light level 1 so you don't need any hardware to interrogatories to your open source network from open-source stack mobile sites stick to what is the purpose of this tool is used for example you can have your whole distance that we don't have that you can perform simulationist and stress they stink we don't have to force a contestant and the bark has other projects
and yeah so we need the last class which you should there can communicate restaurants here and what these applications should do is still performed on dingoes addiction and demodulation it should be able to perform mapping burst modulation and so yeah should fall to DMA quality may type system of GSM and of course finally should tall create URIs interface which is currently supported by 2 years called applications so it's yeah there 2 programs which my feet tall requirements and 1 of the missiles what and is still used in the SmartKom project basically it's design designed to act as the BTS sent it could be used but and the source code is have a mix of C and C + + and you need to understand the whole infrastructure to make some little modifications here and probably will take care about us maturity in the future so also there is geologist sound and so this is the result of the model to play resistance source model where it is easy to modify everything because units when not to try these 2 and yeah this is
why I contacted my friend guilt or to continue work on that direction together so yeah among
the the part of my work was the implementing the bias frosty were followed the GSM and so it is based the evolving set of judges some Nietzsche's relying on the radio the force due some projects was uh the started from the part of April project that years ago in 2 thousand i i that's due April project it was called GSM receiver but it is now much more from just the software from a foreign perceive receiving but it's also because of those the the multiplexing the creating uh versus at this blog already works for decoding differences Luigi got timers for all of the inverse and the there are also out of box applications and the most I think I have want to compose these uh these blocks into working applications these application for like monitoring uh GSM broadcast China uh decoding queues differently because Thomas and analyzing them in a way of shock and also followed searching the GSS active uh in the area so what was the initial projects that status it was the the the fact that follow receiver but what was missing was of course fall transmitter-receiver attainment and workflows the the bill was to implement GSM burst-mode later uh then figure out how to synchronize the transmitted signal uh coming count from the same mold later we've signal received from the best base station and then we actually had some constant the final said that needed to be corrected and in that we had to verify meets the use of the signal transmitted so that the uh the of the of the of the output is is the right time so we don't interfere with anyone licensed bands so very short introduction of
the GSM and signal of the you an interphase the audio interface uh of GSM it uses the time division multiple access uh we've frames containing 8 time slots each time so it carries a 1 GSM burst it's kind of GSM pockets and to these markets are really the only modulated we've Gaussian minimum shift keying modulation and today the position of each burst is precisely defined by uh the frame number and binds the number of images they should be transmitted so the 1st
task was to implement them would later and it was actually quite simple because all the building blocks we're out of already in the in radio so I just had to figure out of the coming them together to make working the GSM the modulator there is already GMS game of later in the radio and then some the some blocks of parking some blocks together uh uh you can perform the fashion encoding connect them together and form that if you and into there needs it should work actually the the other
task was to synchronize the transmit they found the receiver in the received signal and so this wasn't this easy uh voting then the implementation isn't doing very large for this so uh we have the following task we have burst uh coming from the upper layer the have frame number and types of number and then we have to somehow passed them in precisely uh defined moments in the image structure so for these very helpful is the particle that these in the uh inside of the software defined radio that we used to use to use our yeah it allows for me think that's precisely uh defined moments and the the received signal is also a type to leave at the current time so you have the time at which the uh a sample and then the receiver based on these the metadata interact current time and that if he did receive a signal coming from from base station you can synchronize we've these the signal and the associated uh we section pine till frame and finds the number of so the spread of information is then used for for performing the conversion of frame numbers and of numbers and do it transmits the time box the power of the tool uh to that because the time for the new for the task meeting and the based on the this information after the model later the buyers are transmitted by user key at the different moments I it I
so after these the finishing this task we still get some unknown but the constant on the right course mainly by signal processing cargo is like for example a loaf of filtering and also by uh as the public so we needed to take the into account that so we the this is here so the we have a signal coming from the base station to the US API uh at the out of the of we see change because of birds uh these bursts we connected back to the transmitter thing but he's having some known to be that also some known number of frames and then we got rid transmit the signal at some frequency close to the the received signal frequency we then recordable most signals that that the received signal the each compensable signals generalized uh to analyze the received and the lights in figure out how remove the no number of frames in the in the light from the delayed signal and what this level is the the uh I'm about to the delay between the uh that both signals the receiver and transmits money and by us and this weekend measure we use of cross correlation and it's up to you uh yeah you you can measure it the views of cross-correlation and we do the faster the shift from the uh 0 or and the this is the this shift that this shift of the peak of the correlation from the 0 position is actually our or uh the late that we have to put into our take into account in in producing that transmits
so then we had to verify that the transmit the signal amplitudes and the uh money of programs like all small media sort of small theory excited the transmitting constant that is most samples but the forum mobile station it would be kind of relating to the because we get to pass meets the cost of uh stream of samples when and why stations has to transmit something only from time to time uh so uh we actually use the use these burst interface the transmit bursts for each of the 4 each G somewhere centered this many of 1 but it is like the task of finding it and the be there to resynchronize the uh the transmission against of transmission problems but there are some drawbacks and theories is that how of this signal object it should look like for the GSM there's some uh they got periods when the object goes down are but then it's kind of food constant
but this is what the good thing where that have 300 microseconds of Our bursts with God so after some looking for the answer it's after that this problem appears on the on the use of these people 110 and it can be the unit that into that this that you are leaving it up only when we are transmitting and receiving on the the same side of the device and so it so appears only when there is no connection being the phone Dean of the plastic parts and the signal grounds so we we avoid this we can get with mad but uh much better signal amplitude but
then what is the think in front of my birth so what is this after some looking it up of the this is the end of the previous bars and the purpose of the beginning of the uh next burst and it is probably the result of the growth of the data on the use of these uh FPGA processing chain and so yeah and it can be avoided by just adding zeros so that so we find no at the beginning here I would just do that it's not lose some times and the endowments
of goods that could be done was the uh verified transmitted signal spectrum at spectrum analyzer and when you are connecting K content up to the end of the year device you should care they interact aren't always that the fact that it might sit and not for this this idea of signal and for example here for years RPB 200 then it's there is the signal leaf through competent of minus time 13 The Beast from from the main thing on the dance uh harmonic so you should always puts that on our proposed is that especially in case you're losing the wideband antenna so after applying the filter you get something ladies do in that this Parliament my heart was the uh was for I think what's to uh to check that we have to wait for the demon by them by but they're they so when we face more or less work in implementation of that and see the we get something like
that so finally we can now communicate with software defined radio through the application called geologists cen-tury Cs so we cannot the communicate or open source the represented by was maturity most what it is but also these different base stations so here was there to show something more we have some limited
time intended to put a human the yeah
so the 1st thing we need to run this actually lower transfer Europe there is still status then we need to run or Euroscola muchacho access like a bridge between the transurethral was what could be the applications finding the need to run some spoken BB application for example mobile application here and what's happening now that they've started to just synchronized to its station all these men these local network and now we can try to reduce the here example if this is classical music we need to put Torvill tossing club because at the moment we don't have any direct and support interface now let's try and what's happening now we just the formal cation of Dataquest in GSM network and let's see yes and we just got just a distant on that metric and what you can do here is to perform some basic operations like we can request for our number it was it's simple the yeah the implementation is not so stable by so feel free to contribute of ordered and this our rutile extension so we can try to send SMS message to also did the troops back and we should receive it back for example this way so every got channel in which let's try 1 more time of you here in the future thank you for the Lewis wrote to call somewhere because we have some ways sold integration in all hold instruments we now let's focus to call some distant number which would be the the future and to do the phone and so we need to speak about or presentation
and the the current project
status here and it's not so perfect and like to see what what we
what have we achieved his there now we have a full open source where 1 implementation has all you don't need to hunt for calypso fonts anymore you feel free to use software defined radio or you can use any frequency you want for example you can run your networking Wi-Fi banks and so called in this network no no close to the future and G. purest implementation and so for example we can do something like tried to integrate knowledge is a multiple that's like speaks or hopefuls here and can of course this is the ring of shape for a smoker maybe this is a useful hardware platform for the project so if you for your this to you because of the theft and Internet in the order of words in there are times in the line of duty you need all the wins the ground and it would provide you with the questions of so then there was 1 of the things that I I I I want to watch you
and you you use the if what is that the exact pep back to back


  223 ms - page object


AV-Portal 3.21.3 (19e43a18c8aa08bcbdf3e35b975c18acb737c630)