URN Namespace and IMEI

RFC8141 - A Uniform Resource Name (URN) is a Uniform Resource Identifier (URI) [ RFC3986] that is assigned under the "urn" URI scheme and a particular URN namespace, with the intent that the URN will be a persistent, location-independent resource identifier. A URN namespace is a collection of such URNs, each of which is (1) unique, (2) assigned in a consistent and managed way, and (3) assigned according to a common definition. (https://tools.ietf.org/pdf/rfc8141.pdf).

Image courtesy of Diameter-Protocol

RFC7255 - This specification defines how the Uniform Resource Name (URN) reserved for the Global System for Mobile Communications Association (GSMA) identities and its sub-namespace for the International Mobile station Equipment Identity (IMEI) can be used as an instance-id. Its purpose is to fulfil the requirements for defining how a specific URN needs to be constructed and used in the ’+sip.instance’ Contact header field parameter for outbound behaviour. (https://www.rfc-editor.org/rfc/pdfrfc/rfc7255.txt.pdf).

RFC7254 - This specification defines a Uniform Resource Name (URN) namespace for the Global System for Mobile Communications Association (GSMA) and a Namespace Specific String (NSS) for the International Mobile station Equipment Identity (IMEI), as well as an associated parameter for the International Mobile station Equipment Identity and Software Version number (IMEISV) as per the namespace registration requirement found in RFC 3406 [ 1]. The Namespace Identifier (NID) ’gsma’ is for identities used in GSM, Universal Mobile Telecommunications System (UMTS), and Long Term Evolution (LTE) networks. The IMEI and the IMEISV are managed by the GSMA, so this NID is managed by the GSMA. (https://tools.ietf.org/pdf/rfc7254.pdf).

CSA - Site Survey Method/LTE SIBtype1

CSA - Site Survey Method/LTE SIBtype1

Before continuing with GSM/GERAN System Information Message Types, thanks for the enquiries regarding LTE and requests for an example of a systeminformationblocktype(SIB). It would appear there is a requirement to explore LTE and UMTS SIBs some more before moving on to GSM/GERAN. I will do my best to answer some of the enquiries.

For educational purposes only, followingthe masterinformationblock(MIB) having been decoded by the UE a useful example of content for systeminformationblocktype1 was illustrated by Ralf Kreher and Karsten Gaenger (c)2011 using Tektronix K2Air as an example when conducting a LTE investigation into signalling troubleshooting and optimisation.

+-------------------------------------------------------+---------------------------------------------+

|ID Name |Comment or Value |

+-------------------------------------------------------+---------------------------------------------+

|56 05:43:34,555,032 RRC-UU K2AIR-PHY PDSCH LTE-RLC/MAC MAC-TM-PDU (DL) LTE-RRC_BCCH_DL_SCH

systemInformationBlockType1 |

|Tektronix K2Air LTE PHY Data Message Header (K2AIR-PHY) PDSCH (= PDSCH Message) |

|1 PDSCH Message |

|1.1 Common Message Header |

|Protocol Version |0 |

|Transport Channel Type |DL-SCH |

|Physical Channel Type |PDSCH |

|System Frame Number |454 |

|Direction |Downlink |

|Radio Mode |FDD |

|Internal use |0 |

|Status |Original data |

|Reserved |0 |

|Physical Cell ID |0 |

|UE ID/RNTI Type |SI-RNTI |

|Subframe Number |5 |

|UE ID/RNTI Value |'ffff'H |

|1.2 PDSCH Header |

|CRC report |CRC ok |

|HARQ process number |0 |

|Reserved |0 |

|Transport Block Indicator |single TB info |

|Reserved |0 |

|1.2.1 Transport Block#1 Information |

|Transport Block#1 Size |144 |

|Modulation Order DL 1 |QPSK |

|New Data Indicator DL 1 |new data |

|Redundancy Version DL 1 |1 |

|Reserved |0 |

|Modulation Scheme Index DL 1 |5 |

|Reserved |0 |

|1.2.2 Transport Block Data |

|TB1 Mac-PDU Data |40 51 00 21 00 00 20 00 10 0c 14 01 10

21 00 68 22 b6 |

|Padding |'0068'H |

|1.3 Additional Call related Info |

|Number Of Logical Channel Informations |1 |

|1.3.1 Logical Channel Information |

|LCID |0 |

|RLC Mode |Transparent Mode |

|Radio Bearer ID |0 |

|Radio Bearer Type |Control Plane (Signalling) |

|Spare |0 |

|Spare |0 |

|Logical Channel Type |BCCH |

|Call ID |'fffffff5'H |

|3GPP LTE-RLC/MAC Rel.8 (MAC TS 36.321 V8.5.0, 2009-03, RLC TS 36.322 V8.5.0, 2009-03) (LTE-RLC/

MAC) MAC-TM-PDU (DL) (= MAC PDU (Transparent Content Downlink)) |

|1 MAC PDU (Transparent Content Downlink) |

|MAC Transparent Data |40 51 00 21 00 00 20 00 10 0c 14 01 10

21 00 68 22 b6 |

|RRC (BCCH DL SCH) 3GPP TS 36.331 V8.5.0 (2009-03) (LTE-RRC_BCCH_DL_SCH)

systemInformationBlockType1 (= systemInformationBlockType1) |

|bCCH-DL-SCH-Message |

|1 message |

|1.1 Standard |

|1.1.1 systemInformationBlockType1 |

|1.1.1.1 cellAccessRelatedInfo |

|1.1.1.1.1 plmn-IdentityList |

|1.1.1.1.1.1 pLMN-IdentityInfo |

|1.1.1.1.1.1.1 plmn-Identity |

|1.1.1.1.1.1.1.1 mcc |

|1.1.1.1.1.1.1.1.1 mCC-MNC-Digit |2 |

|1.1.1.1.1.1.1.1.2 mCC-MNC-Digit |9 |

|1.1.1.1.1.1.1.1.3 mCC-MNC-Digit |9 |

|1.1.1.1.1.1.1.2 mnc |

|1.1.1.1.1.1.1.2.1 mCC-MNC-Digit |0 |

|1.1.1.1.1.1.1.2.2 mCC-MNC-Digit |0 |

|1.1.1.1.1.1.2 cellReservedForOperatorUse |notReserved |

|1.1.1.1.2 trackingAreaCode |'0000'H |

|1.1.1.1.3 cellIdentity |'2000100'H |

|1.1.1.1.4 cellBarred |notBarred |

|1.1.1.1.5 intraFreqReselection |notAllowed |

|1.1.1.1.6 csg-Indication |false |

|1.1.1.2 cellSelectionInfo |

|1.1.1.2.1 q-RxLevMin |-65 |

|1.1.1.3 freqBandIndicator |1 |

|1.1.1.4 schedulingInfoList |

|1.1.1.4.1 schedulingInfo |

|1.1.1.4.1.1 si-Periodicity |rf16 |

|1.1.1.4.1.2 sib-MappingInfo |

|1.1.1.4.2 schedulingInfo |

|1.1.1.4.2.1 si-Periodicity |rf32 |

|1.1.1.4.2.2 sib-MappingInfo |

|1.1.1.4.2.2.1 sIB-Type |sibType3 |

|1.1.1.4.2.2.2 sIB-Type |sibType6 |

|1.1.1.4.3 schedulingInfo |

|1.1.1.4.3.1 si-Periodicity |rf32 |

|1.1.1.4.3.2 sib-MappingInfo |

|1.1.1.4.3.2.1 sIB-Type |sibType5 |

|1.1.1.5 si-WindowLength |ms20 |

|1.1.1.6 systemInfoValueTag |22 |

This form of analysis provides an excellent grounding when conducting ICCSA.Why would that be so? Familiarisation with this education content enables knowledge to be gleaned from the real-world SIBs detected by the UE at particular locations. Importantly information that informs the UE about varying cells benefits an investigation.  For instance, we know that when the UE has successfully received and decoded MIB and SIBs type 1 and 2 etc during its travels SIB type9 might identify (H)eNobeB that is available. To be clear that latter information provides two unique pieces of information. (1) The identity of the radio source (2) it is location specific to tens of metres in an area thus refines location identification where the UE would have dwelt (dwell time - slow moving UE).

It also refines the location for the investigation and even where SIB1 and SIB2 provide a wider location area the UE detection (SIB type9) of the (H)eNobeB coverage would have the effect of demonstrating  pre-requisite requirement of proximity to an area. Now readers could point out how would the person conducting the ICCSA know about the (H)eNobeB in the first place if call/data records are not available. For those situations where immediate is important aspect of current bandit surveillance the UE stores relevant information of the radio resources in an area for up to 3-hours after which old data are discarded. For a live UE acquisition this time frame could be useful. For a UE switched off (e.g. at the target site area) retains that information and requires extraction and harvest without invoking UE power up and network detection and registration.

CSA - Site Survey Method/LTE-UMTS SIBs

There is a huge volume of materials and standards to be considered when undertaking study or work as an InnerCity CSA (ICCSA) expert, technician or student. However, the materials and standards referred to at my webblog aim to control the flow of such volumous information and provide instead an easy guide to seeking out the information experts, technicians or students can be exposed to when involved with ICCSA.

A highly defined smartphone etc can be offered services by a range of mobile network access systems e.g. GSM, GERAN, UTRAN, e-UTRAN etc when switched ON and actively in use or in idle mode. Access system information for LTE and UMTS are mapped in System Information Blocks (SIBs). When conducting ICCSA test measurement it is useful to identify which broadcasted SIBs contain data to help understand the survey results. Knowing the content allocated to SIBs can assist enormously in interpretation and when considering the propositions highlighted in the previous discussion thread - http://cellsiteanalysis.blogspot.co.uk/2014/08/csa-site-survey-method4cell-types.html



Below are commonly referred to LTE/UMTS SIBs. GSM and GERAN data are mapped to System Information Types that will be given in the next discsssion.

LTE System Information Blocks
***************************
SIB 1 contains PLMN identity, tracking area code, and CI of the broadcasting cell. Q-RxLevMin minimumRSRP threshold that a broadcasting cell should be measured before initial cell selection, and later for random access performed by UE. SIB Mapping Info included to inform the UE which SIBs are transmitted and how they are scheduled.

SIB 2 contains timers and constants, access barring information, UL frequency information, and UL bandwidth information.

SIB 3 contains parameters for the cell reselection procedure.

SIB 4 contains neighbour cell information for intra-frequency cell reselection.

SIB 5 contains information for interfrequency cell reselection.

SIB 6 contains information for inter-RAT cell reselection to the UTRAN.

SIB 7 contains information for inter-RAT cell reselection to the GERAN.

SIB 8 contains information for inter-RAT cell reselection to CDMA2000.

SIB 9 is used to broadcast the home eNB name (HNB name).

SIB 10 and SIB 11 can be used to broadcast warning information to subscribers (e.g. tsunami warnings).

SIB 12 assigned for Commercial Mobile Alerting System (CMAS) information usage


UMTS System Information Blocks
*****************************
SIB 1 NAS System Information, UE Timer and counter for RRC idle and connected mode

SIB 2 URA Identity

SIB 3 Parameter for Cell Selection and Cell Reselection

SIB 4 Parameter for Cell Selection and Cell Reselection in RRC connected mode

SIB 5 Parameter for configuration of Common Physical Channel (CPCH) of actual cell

SIB 6 Parameter for configuration of Common and shared Physical Channel of actual cell

SIB 7 Fast changing parameter for uplink Interference and Dynamic Persistent Level

SIB 8 Static CPCH Information of actual cell [FDD only]

SIB 9 CPCH Information of actual cell [FDD only]

SIB 10 Information for UE, which DCH is controlled by Dynamic Resource Allocation Control Procedure

SIB 11 Measurement Control Information of actual cell

SIB 12 Measurement Control Information of actual cell in RRC connected mode

SIB 13 ANSI-41 System Information

SIB 13.1 ANSI-41 RAND Information

SIB 13.2 ANSI-41 User Zone Identification

SIB 13.3 ANSI-41 Private Neighbour List

SIB 13.4 ANSI-41 Global Service Redirection

SIB 14 UL outer loop power control information for common and dedicated physical channels in RRC idle and connected mode

SIB 15 Information for UE positioning method

SIB 15.1 Information for UE GPS positioning method with Differential Global Positionig System (DGPS) correction

SIB 15.2 Information for GPS Navigation-Model

SIB 15.3 Information for GPS Almanac, ionospheric and UTC Model

SIB 15.4 Ciphering Information of SIB 15.5

SIB 15.5 Information for OTDOA UE positioning method

SIB 16 Information of Radio Bearer, transport and physical channels for UE in RRC idle or connection mode in case of Handover to UTRA

SIB 17 Fast changing parameter for the configuration of Shared Physical Channels in RRC conected mode [FDD only]

SIB 18 PLMN Identifies neighbour cells

CSA - Site Survey Method4/Cell Types

Cell types
GSM reports, as far back as 20 years ago, distinguished three kinds of cells as the growth in GSM installations massively increased following popularity as a preferred digital cellular network: large cells, small (mini) cells and micro cells. The main difference between these kind of cells lay in the cell range, the antenna installation site, and the propagation model applying to each of them. Moreover, these cells could be overlayed one on top of another to provide coverage for varying traffic conditions and illustrated in the previous discussion http://cellsiteanalysis.blogspot.co.uk/2014/07/csa-site-survey-methodmobility-models.html.

CSA has been subjected to understanding cell layer tiering involvement in a particular geographical area and what impact the finding of tiering might have determined from radio test measurement results, and what impact the results might infer for a particular investigation. In the previous discussion on Mobility Models it highlighted a simple issue: why walk tests are important to mimic the pedestrian's experience of obtaining mobile services. Germane and relevant, whilst the mobile networks are highly intelligent networks and use memory and memoryless in their propagation models, CSA examiners, students and experts cannot apply intelligent algorithms in the manual function of their work when conducting site surveys. It is, therefore, necessary to distinguish processes and procedures hidden within the intelligent network functionality that provide us (CSA examiners, students and experts) with knowledge that helps us gain skills and experience in the performance of the work we do.

So  we know "walk tests" are unavoidable (thus inescapable) forming part of the methodology we should apply, where relevant, during site surveys. Whilst this requirement is a basic simple binary style approach to CSA that doesn't mean to suggest mobile networks aren't sophiscated, convoluted, NASA style complex system because mobile networks are very much the latter. These grass root levels are important to CSA. For instance a GSM mobile network may use Cell Selection Procedures C1 and C2. The network can use components from C2  (cell reselection) to identify coverage for a slow moving mobile (e.g. pedestrian/walk test) which can be used to understand the microcell coverage. Drive testing equally needs to be represented for the benefits it provides for CSA.

    

Above, three tiers of cell coverage have been illustrated. Microcells are distnguished as a cell type because predominantly this type of cell in GSM (or CDMA for that matter) is usually represented as localised coverage to a small area. Pedestrian is seen as relevant to it. However, vehicular mobile usage is largely predicted within the network as "fast moving". Let us take the case of the getaway car speeding away from the scene of crime. Would it not seem strange to you to find the target's mobile phone call records identifying a number of Microcell IDs designed to cope with long dwell time in an area associated with slow mobile movements (e.g.5~10mph) compared with Macrocell umbrella coverage designed to handle accelerated speeds (e.g. 30~70mph). Why would the getaway car be driving so slowly after a crime, unless the *bogey wanted to be caught red-handed and why s/he commited the crime in the first place just to be arrested? On first blush of the call record evidence it wouldn't make sense.

*The term bogey has been adopted from the military theatre of war identification procedure representing an un-identified (unknown criminal) target, whereas a bandit is an identified (known criminal) target. In criminal investigations the latter can also suggest surveillance in progress on the target's activities.

But drive testing can throw up unexpected issues. CSA demands keeping an open mind and, as previously mentioned at my blogs, CSA examiner, student and expert should be "not only be environmentally aware, but equally be environmentally astute." A case I dealt with in the North of England concerned a series of smash-n-grabs at wholesale and retail outlets.  From my radio tests I suggested the radio evidence did not follow the getaway route the police required that I test. CSA involves noticing factors that could impede or record a particular route. In this case a speed camera that was in lock-n-load (active) to capture speeding vehicles was located at an early stage on the suggested getaway route. When I asked did the speed camera record a speeding violation, the response came back "no", yet the ascertion by the police was the getaway vehicle was speeding. However, the radio test measurement survey along the complete route did not entirely match the cell IDs in the call records either as some of the cell IDs were for slower mobile traffic and cells covering a middle layer coverage area and the use of these cells suggested the mobile dwell time was not travelling outside a certain geographical area. Eventually, a more senior detective suggested a route that veered away from the first route getaway route. My attention was drawn to an area inbetween local buildings, a mud track leading to a field and a nearby cemetary and housing estate. Infact the bogeys turned out to be previously known bandits and the entire operation of the smash-n-grabs was orchestrated from a house on the estate sited perfectly for comings and goings for the many crimes but quite hard to detect. CSA played an effective part to support other evidence and intel.       

However, umbrella macrocell coverage in a geographical location can be used to support high speed getaways e.g. where CCTV has recorded or an eyewitness had seen the getaway vehicle speeding through dense urban area. Given the speed of the vehicle the network would be detecting the mobile's short dwell time in that area. The omission of use of overlayed microcells providing limited area coverage is a suggestion of fast moving traffic. The use of a macrocell would not be out of place supporting the notion of a fast moving mobile. This can be stated in relation to the density of non-used microcells and their cell boundarys compared to macrocell cell boundaries and, of course, any location updates, time, velocity etc.

Since 2010 Cells types have rapidly moved on with a split between voice/data and data-only cells transforming the way CSA is and will be conducted in the future. For instance, there are increases in carriers (2G frequencies allocation migrating (re-use) to 3G frequencies allocation) Moreover, with LTE linking with WiFi/WLAN etc there are enormous advantages and dis-advantages that have crept into CSA site survey methodology.

 
The impact of these changes requires improved comprehension about the various cells and as higher frequencies are used or are brought into use cell coverage gets smaller. This fact is a benefit because the approximated location of the mobile is improved and significantly improves where smaller cells are relevant. It may not be GPS accuracy but there seems no reason why it could not meet justification under an e.g. Daubert test. Furthermore, it doesn't means CSA should jettison early styles of CSA site survey method which will remain relevant for some years to come. But CSA will become even more localised creating a specialism in InnerCity CSA (ICCSA) compared with rural CSA. A beneficary of  ICCSA knowledge will be the neuromancer cybercrime arena utilising our forensic and investigative skills to comprehend the technicality behind a suspected crime defined by the outcome from particular usage of technology.

Site survey methods do not have to be overly complicated, merely identify the radio technology at given points and by using a structured appraisal, distinguishing each wireless carrier available at particular geographical locations, to show the relevance to an investigaion or crime scene.

So what are the potentially inter-connected Cell types that fall within the scope of CSA large cell and small cell environments:

Macrocells

Minicells

Microcells

Metrocells

Picocells

Nanocells

Femtocells

WIMAX cells

WLAN cells

WiFi cells

etc

And in support of that environment it should not under-estimate the importance of devices capability from providing services and to accessing services. This mean from not simply the network, but the radio network e.g. BTS/(e)NodeB/H(e)NB etc to the enhanced (U)SIM and handset terminal. That requires knowning which Release (R) is relevant to the investigation:

R99    (Release 1999)

Rel-4    (Release 4)
Rel-5    (Release 5)
Rel-6    (Release 6)
Rel-7    (Release 7)
Rel-8    (Release 8)
Rel-9    (Release 9)
Rel-10    (Release 10)
Rel-11    (Release 11)
Rel-12    (Release 12)  

etc

LTE-WiFi Aggregation

LTE-U workshop: LAA (Licensed Assisted Access) - Use cases and scenarios

 

LTE workshop: LAA (Licensed Assisted Access)

New Book - RFPS (Radio Frequency Propagation Survey)

Joe Hoy from Forensic Analytics joins us this month at Cell Site Analysis blog to outline the purpose and content for his forthcoming book regarding  RFPS (Radio Frequency Propagation Survey).

What is your background, Joe?
"I am a telecoms engineer and trainer with 27 years of industry experience. For the last 17 years I have concentrated on telecoms training, specialising in cellular technologies particularly, for the past few years, 4G LTE.

"I have also worked extensively as a forensic cell site analyst and expert witness, contributing to many high-profile cases for either the prosecution or the defence. I’ve undertaken the work of the RFPS surveyor, capturing measurements of cellular coverage at crime scenes and other locations and have also provided extensive training for cell site analysts and RFPS engineers.



What is your current employment?
 "I now run a company called Forensic Analytics, we develop and supply software tools, such as our CSAS (Cell Site Analysis Suite) tool, to police forces and cell site analysis companies to aid them in processing call data records and RF survey results and also help them to effectively analyse, query, visualise and present that data. Traditionally, cell site analysis and their attendant forensic radio surveys were undertaken by external cell site experts, but there has been a growing trend, in the UK but also elsewhere, for law enforcement agencies to reduce the cost of forensic cell site investigations by taking some or all of the survey work ‘in house’.

Who are the potnetial readers of your book and why? 
"Many police forces now employ their own radio surveyors who undertake radio surveys for them – although there are many experienced radio engineers included in this set, in many cases the people being employed to perform these tasks are investigators and do not come from a cellular radio engineering background. Their understanding of the background of the role can therefore be somewhat limited and their technical understanding of the operation of the networks they are surveying may benefit from additional enhancement.

"In light of this, I have been asked by John Wiley Sons, the technical book publisher, to write a book that outlines the theory and practice related to the RFPS (Radio Frequency Propagation Survey) discipline within the field of cell site analysis.


Can you provide CSA blog readers with a brief outline of the content of the book
 "The first half of the book provides a reasonably simple but nonetheless detailed overview of radio theory, of basic cellular network principles and concepts and of the operation of cellular networks. The radio theory section provides an introduction to basic radio theory and offers simple explanations of the mathematical concepts that underlie radio measurements scales such as dB and dBm. The network types section is mainly focused on 3GPP network types – GSM, UMTS and LTE – but also provides an overview of the operation of other network types, such as 3GPP2 cdmaOne/CDMA2000/EV-DO, Chinese TD-SCDMA, WMIAX, WiFi, iDEN, TETRA and others.

"One of the main aims of the first half of the book is to introduce new surveyors to enough fundamental concepts to enable them to understand the meaning and significance of the measurements they will capture during surveys. It also provides details of the specific types of measurement that are captured for each network type and gives an idea of the typical range of values to be expected.

"The second half of the book focuses on forensic radio surveys; the various types of survey, the techniques employed for each survey type, the considerations and potential problems that can be encountered when surveying different types of network.

"This book is intended to be used as both a text book and as an aide memoire handbook by forensic radio survey engineers, particularly those working for official police agencies. It is not intended to act as a detailed technical reference for cell site experts or others who already understand these topics.
 
Which markets would benefit from your book?
"There is a growing market for cell site analysis in general. The UK has largely pioneered this area of forensic activity and has an experienced and mature market but the market in other parts of the world is still developing. Many countries use cell site techniques but base their conclusions purely on the proximity of a cell to a significant location. This isn’t ‘proof’ in an empirical sense and this type of cell site evidence is subject to challenge and dismissal in court. As cell site markets and techniques mature in other countries there will be a need for proper RFPS evidence and therefore, I hope, a growing market for the information provided in this book.


When will your book be available and how do readers get hold of a copy?
 "The book is due to be published by Wiley in the Autumn, but for further details please contact me at joe.hoy@forensicanalytics.co.uk. For details of our CSAS tool go to www.forensicanalytics.co.uk."

MTEB CSA Fundamentals Training

The MTEB has received an increase in the number of enquiries about fundamental (core) training in Cell Site Analysis.

It could be useful for readers to be reminded in brief, scoping CSA requires applying a wide-ranging methodology incorporated in the investigation and analysis of mobile device activity and mobile communications. That means a CSA participant needs to understand:

- the science operating behind and underpinning CSA
- identifying forensic stepping stones for CSA
- evidence produced for CSA
- reporting on the findings from the conducted CSA.

None of the MTEB subject headers (below) on the course for each of the sections takes precedence over another as all topic elements in the course requires the investigator/examiner/expert to:

- constantly balance and accommodate all of the investigation elements and lines of enquiry
- correlate constants vis-a-vis ambiguities and determine the findings in each of the topics and confirm what the combined findings mean from all topics when aggregrated
- findings should support and cooroborate / deny and disprove the investigation outcome set out in the engaging party's instructions.

MTEB Cell Site Analysis Fundamentals Course
[]GSM []GSM/(W)CDMA/ []GSM/(W)CDMA/LTE []Other Bespoke Networks

Section 1 Introduction - CSA Fundamentals
Section 2 Legal and Technical Frameworks
Section 3 Guidelines, Specifications, Standards. Reference Sources etc
Section 4 PLMN - Mobile Network Installation and Mobile Elements
Section 5 Originating evidence
Section 6 Cross-referencing originating sources of evidence
Section 7 Techniques/skills for Cell Site Identification
Section 8 Techniques/skills for Cell Site Analysis
Section 9 Techniques/skills for Radio Results Analysis
Section 10 Final Analysis and Reporting

sim2usim

Examination and Evidence from SIM and USIM Cards. Now an open blog. 

http://sim2usim.blogspot.co.uk/

(U)SIM Examination (Physical) Pt1

(U)SIM Examination (Physical) Pt1

We begin with GSM as this is the original starting place where examiners first learned about subscriber identity modules (SIM). There are many ways to learn about SIM: using a SIM reader tool is one way, receiving instruction during training that concentrates on the types of user and network data that can be harvested by examiners. An education and training process can equally include a training module or modules on the physical aspects of a card and identify, for the examiner, material parts of the SIM, the known routes to understanding electrical aspects, processing aspects, storage geometry and memory mapping, so on and so forth. The thinking here is analogous to the way in which there is an expectation that a computer examiner would understand HDD disc geometry, clusters and sectors, BIOS etc even before entering into the search and study of the 'content' that may be recorded on the disc. It is or should be the same for (U)SIM.

The SIM Card can be seen as a composition of at least three constituent parts:

- The physical card (the storage carrier).
- An integrated circuit card micro-processing chip (the operating system and content storage device).
- The subscriber identity module; an area of physical memory allocated at manufacturing for pre-market and post-market recording by the mobile network operator and SIM user.
 -  A fourth constituent part could be a Card with an etched antenna for RFID/NFC for use by (US)SIM (but this part is not included or discussed at this stage).
- etc

To enable test and inspection of these constituent parts GSM approved and adopted GSM11.17 to assist manufacturers, operators and service providers help formalise and uniform the test and inspection procedures rather than have a mish-mash of randomly selected tests for SIM cards submitted for use in GSM. The former is highly desirable as the goal of GSM has always be about interconnection-compatiblity and interconnection backward-compatibility. By way of illustration, a GSM SIM Card Phase 1 should still be able to be inserted into a GSM Phase 2+ mobile device and allow communications to take place, unless the operator or device manufacturer has declared and stated otherwise.

From an examiner's viewpoint we would desire to know how those three constituent parts translate to the work we do? Some examples are set out below

Physical Card
Due to the form factors used in GSM we can make assessment to determine the supply chain and manufacturer of the card itself. We look at the card to see if has been cut down for use and any attempts of anonymity by removal of the SIM Serial Number (SSN) compared to manufacture polarisation techniques. Later 3G/LTE USIM Cards have undergone some changes since GSM's inception; the latter will be dealt at a later date.


 Image courtesy of wikipedia - http://en.wikipedia.org/wiki/Subscriber_Identity_Module

ICC Chip
Manufacturer and technical specification are important to determine a range of potential evidence, including release into the marketplace and technological and electronic capability. Clearly the geometry and memory mapping are important. There are various techniques to deal with a card with a damaged chip. One example is called 'acid-etching' used to gain access to the physical chip itself by removal of the outer protective coverings used in the manufacturing process. 

 
  Image courtesy of wikipedia - http://en.wikipedia.org/wiki/Subscriber_Identity_Module

Physical Memory
Determining geometry and memory mapping forms part of the testing and inspection process set out in GSM1117. We can use these procedures to formulate a forensic analysis programme, similar to the way in which computer forensic examiners seek to determine specifically data discovered and recovered from a particular memory location on the HDD and define the data from its binary and encoded states and any formatting that may be applicable to the data. That being so, would it be out of the question in SIM examination terms for the EFBCCH file to be formatted as .bmp?  Below are a set of powerpoint slides I have prepared so that examiners can comprehend procedures approved and adopted for test and inspection for GSM SIM Cards. Later on when we 3G/LTE (U)SIM this GSM starting point assists formulate how to identify differences between the various (U)SIM/LTE cards but equally identify expansion of technology services and content so the examination limit or avoid omissions during the investigative/evidential process.      

Operational Audit Check (OAC) is part of Cell Site Analaysis (CSA)

 

 

There is a news aticle on News96.5.com about a mast (US cell tower) that caught figure during an install/maintenance work (http://www.news965.com/news/news/local/cell-phone-tower-burning-could-fall/nZYBg/). The article provides us with a useful reminder when conducting cell site analysis (CSA) to remember to conduct an operational audit check (OAC) and request confirmation that the target mast and the density of support radio coverage masts in the immediate area were all operational at the material time. This should be requested as soon as practicalable to do so.

Invariably, an event (e.g. a serious crime) requires instant action and requires, if relevant, knowing the cell coverage at the scene of crime (SoC) and the coverage in surrounding areas (e.g. identifying potential get away routes). It could impact the investigation if an OAC is not conducted regarding the density of surrounding masts and it later comes to light a mast was out of commission for a period and other masts in trh surrounding area had their coverage increased.

In some cases, it may not be possible at short notice to draught-in coverage from other masts and a radio black spot may occur. This, too, is in important to anticipate and be considered when analysing call records, road networks and the density of masts (thus coverage) upon the landscape. Moreover, if the out of commission mast is at a central location of a road network or town/city, consider also the base stations delivering small cell/micro cell coverage. Many of these base stations have their antennas tilted. There are two types of tilt commonly available: electrical and mechanical. Electrical tilt enables the network to remotely alter the tilt angle of the antennas. Mechanical tilt requires an engineer to visit site and mechanically alter the antenna tilt. Here again, not considering these points could mean an investigation can include arriving at erroneous conclusions that may be uncovered later on.

My experience of performing OAC for particular cases can vary from the experience of others. I am not able to say why information I have found was available was not accessible to other experts/investigators. It seems to me that an illustration of the information that supports the above comments I made should be demonstrated. I have hidden some cell site/mast details from the data served in a particular case, that of site name, address and NGR, as this relevation is not necessary to specifically identity the cell site/mast details in that particular case. However, it is assumed that site name, address and NGR are standard details that form part of the request of the information sought from a particular operator.

Below is further reading material I hope you will find helpful, which I have produced here at the blog in the past, and that the events/actions mentioned in them might provide further support or clarity to you about the issues discussed above or during an investigation.

LTE, Test Trials and Cell Site Analysis
http://trewmte.blogspot.co.uk/2012/10/lte-test-trials-and-cell-site-analysis.html

CSA - R&TTE Directive
http://trewmte.blogspot.co.uk/2012/06/csa-r-directive.html

GSM Mast Installations (Density)
http://trewmte.blogspot.co.uk/2008/06/gsm-mast-installations-density.html

Basic Terrain Plot, GPS & CSA
http://trewmte.blogspot.co.uk/2011/11/basic-terrain-plot-gps-csa.html

CSA: From Ockham's (Occam's) Razor to Checking Masts
http://trewmte.blogspot.co.uk/2008/11/csa-from-ockhams-occams-razor-to.html

Cell Site Analysis (CSA) Images
http://trewmte.blogspot.co.uk/2009/08/cell-site-analysis-csa-images.html

Cell Site Analysis (CSA) Images Part 2
http://trewmte.blogspot.co.uk/2009/08/cell-site-analysis-csa-images-part-2.html

Cell Site Analysis (CSA) Images
http://trewmte.blogspot.co.uk/2009/08/cell-site-analysis-csa-images.html

Mobile Phones and Fringe Coverage
http://trewmte.blogspot.com/2008/11/mobile-phones-and-fringe-coverage.html

Evolving Cell Site Analysis (CSA)
http://trewmte.blogspot.co.uk/2011/05/evolving-cell-site-analysis-csa.html

Mini Course in Cell Site Identification (Pt3.s2)
http://trewmte.blogspot.co.uk/2012/04/mini-course-in-cell-site-identification.html

Mini Course in Cell Site Identification (Pt3.s1)
http://www.trewmte.blogspot.co.uk/2012/01/mini-course-in-cell-site-identification.html

Mini Course in Cell Site Identification (Pt2)
http://trewmte.blogspot.com/2011/12/mini-course-in-cell-site-identification_31.html

Mini Course in Cell Site Identification (Pt1)
http://trewmte.blogspot.com/2011/12/mini-course-in-cell-site-identification.html

(U)SIM Examination (Physical) Pt1

(U)SIM Examination (Physical) Pt1

We begin with GSM as this is the original starting place where examiners first learned about subscriber identity modules (SIM). There are many ways to learn about SIM: using a SIM reader tool is one way, receiving instruction during training that concentrates on the types of user and network data that can be harvested by examiners. An education and training process can equally include a training module or modules on the physical aspects of a card and identify, for the examiner, material parts of the SIM, the known routes to understanding electrical aspects, processing aspects, storage geometry and memory mapping, so on and so forth. The thinking here is analogous to the way in which there is an expectation that a computer examiner would understand HDD disc geometry, clusters and sectors, BIOS etc even before entering into the search and study of the 'content' that may be recorded on the disc. It is or should be the same for (U)SIM.

The SIM Card can be seen as a composition of at least three constituent parts:

- The physical card (the storage carrier).
- An integrated circuit card micro-processing chip (the operating system and content storage device).
- The subscriber identity module; an area of physical memory allocated at manufacturing for pre-market and post-market recording by the mobile network operator and SIM user.
 -  A fourth constituent part could be a Card with an etched antenna for RFID/NFC for use by (US)SIM (but this part is not included or discussed at this stage).
- etc

To enable test and inspection of these constituent parts GSM approved and adopted GSM11.17 to assist manufacturers, operators and service providers help formalise and uniform the test and inspection procedures rather than have a mish-mash of randomly selected tests for SIM cards submitted for use in GSM. The former is highly desirable as the goal of GSM has always be about interconnection-compatiblity and interconnection backward-compatibility. By way of illustration, a GSM SIM Card Phase 1 should still be able to be inserted into a GSM Phase 2+ mobile device and allow communications to take place, unless the operator or device manufacturer has declared and stated otherwise.

From an examiner's viewpoint we would desire to know how those three constituent parts translate to the work we do? Some examples are set out below

Physical Card
Due to the form factors used in GSM we can make assessment to determine the supply chain and manufacturer of the card itself. We look at the card to see if has been cut down for use and any attempts of anonymity by removal of the SIM Serial Number (SSN) compared to manufacture polarisation techniques. Later 3G/LTE USIM Cards have undergone some changes since GSM's inception; the latter will be dealt at a later date.


 Image courtesy of wikipedia - http://en.wikipedia.org/wiki/Subscriber_Identity_Module

ICC Chip
Manufacturer and technical specification are important to determine a range of potential evidence, including release into the marketplace and technological and electronic capability. Clearly the geometry and memory mapping are important. There are various techniques to deal with a card with a damaged chip. One example is called 'acid-etching' used to gain access to the physical chip itself by removal of the outer protective coverings used in the manufacturing process. 

 
  Image courtesy of wikipedia - http://en.wikipedia.org/wiki/Subscriber_Identity_Module

Physical Memory
Determining geometry and memory mapping forms part of the testing and inspection process set out in GSM1117. We can use these procedures to formulate a forensic analysis programme, similar to the way in which computer forensic examiners seek to determine specifically data discovered and recovered from a particular memory location on the HDD and define the data from its binary and encoded states and any formatting that may be applicable to the data. That being so, would it be out of the question in SIM examination terms for the EFBCCH file to be formatted as .bmp?  Below are a set of powerpoint slides I have prepared so that examiners can comprehend procedures approved and adopted for test and inspection for GSM SIM Cards. Later on when we 3G/LTE (U)SIM this GSM starting point assists formulate how to identify differences between the various (U)SIM/LTE cards but equally identify expansion of technology services and content so the examination limit or avoid omissions during the investigative/evidential process.      

US Handset Serial Number Databases

US Handset Serial Number Databases

US operators maintain their own stolen and blacklisted cellphone databases. As of the 31st October 2012 the GSM operators AT&T and T-Mobile began sharing their databases. CDMA operators Verizon and Sprint have taken the decision to merge their databases but that will not be complete until November 2013, so we are told.

The said objective of these initiatives are to improve track and trace. As an example, GSM uses a 56-bit decimal digit s/n, whereas CDMA uses a 56-bit hexadecimal digitals s/n. However, in the US there are variations of s/ns to consider.

The engine for these changes is driven by the FCC initiative - http://www.fcc.gov/document/announcement-new-initiatives-combat-smartphone-and-data-theft

To accommodate this and other cellphone/cellular changes I have altered my CDMA training material and GSM training material. As consequence these changes will also have an impact on WCDMA and LTE, either on a national level or international level. These training materials have also changed, too.

_________________
Institute for Digital Forensics (IDF) - LinkedIn
Mobile Telephone Examination Board (MTEB) - LinkedIn

LTE 4GEE

LTE 4GEE

As Orange/T-Mobile has launched Everything Everywhere (EE) 4G/LTE ahead of the other major UK MNO players I took a web-stroll over to their website to look at their coverage checker.

https://explore.ee.co.uk/coverage-checker

Improving the coverage checker maps
I made several post code area searches to familiarise myself how coverage is presented. It isn't up to much at this stage. Too much vague generality, whereas customers, I think, would much prefer to see a single cell coverage map for each BTS/NodeB/eNode (or Mast, so to speak) identifying signal strength (defined by colours) coverage every 100-metres (small cell) or 500-metres (macro-cell) or in the alternative coverage including coloured signal strength upto the equal power boundary.   

Skyfall, MI5 and MI6
During my search I looked at various locations and, as I have recently been to see the latest Bond 007 Film, 'Skyfall' ('excellent' is my rating), I wondered what MI5 and MI6 coverage would be like? A quick web search for the addresses and enter post code to EE's website and here is coverage to MI5 HQ:

Naturally, they get excellent coverage.

LTE, Test Trials and Cell Site Analysis

LTE, Test Trials and Cell Site Analysis

There are some strange views floating around that cell site analysis is highly difficult or impossible now we have moved from GSM and 3G on to LTE, with it being so new that there is uncertainty.  I can imagine that LTE may cause speculation because LTE hasn't been sufficiently rolled out in the UK and it may appear there is no mature facts or figures upon which to rely. But, infact, there are facts and figures that have been generated in refining the LTE system for roll out and, of course, that knowledge benefits cell site analysis.

Back in 2009 mobile operator Telefonica O2 started conducting LTE test trials in Slough Berkshire UK. Throughput data quantification, radio test measurements, surveys, etc created a plethora of statistical information which O2 used in planning its LTE network.  

Those tests included a variety of known components required for analysis, which can be seen in the 'Key' legend.

Consideration of LTE requires tests to be conducted not only with a static analysis and assessment approach but also distance and velocity analysis and assessment approach, too. That is apart from the environmental considerations. For CSA that means drive tests alone are not good enough; nor using passive radio test measurement devices could fulfil the requirements of an analysis and assessment approach to comprehend an LTE service at a particular location. TrewMTE blog readers may recall I gave a helpful tip about looking at data and location here: Data Usage in Cell Site Analysis - http://trewmte.blogspot.co.uk/2012/08/data-usage-in-cell-site-analysis.html.

Of course, consideration of the particapting RF transceiver elements present the same requirement for cell site analysis to understand the arrangements at the base station for LTE as it did for GSM/3G.

TrewMTE blog readers may also recall that I set out a series of discussions about Cell Site Identification presented as primers:

Mini Course in Cell Site Identification (Pt1)
http://trewmte.blogspot.com/2011/12/mini-course-in-cell-site-identification.html

Mini Course in Cell Site Identification (Pt2)
http://trewmte.blogspot.com/2011/12/mini-course-in-cell-site-identification_31.html

Mini Course in Cell Site Identification (Pt3.s1)
http://trewmte.blogspot.co.uk/2012/01/mini-course-in-cell-site-identification.html

I have completed the last primers in the series above and was going to publish them, having given readers sufficient time to go away and research/study the earlier parts. However, this matter needed airing first, due to misconceptions that are floating about out there. I shall publish the other primers later on.

Do remember, I have used the term 'cell site' to capture readers' imaginations to immediately link readers' thoughts towards cell site analysis (CSA). However, cell site can be used to mean e.g. a GSM cell site, a 3G NodeB or a LTE eNode. 

To leave the user device out of any analysis would be to precide over an incomplete investigation. Readers will note in Cell Site Identification Part 1 an illustration was given linking devices and components that are required for consideration when investigating/researching during CSA. The MS (handset/SIM) forms part of the investigation. O2 LTE test trials equally identified two devices used for their tests.

The experienced investigator will immediately see that the devices in the image above, used during test trials, do not of themselves fit immediately with the common scenarios of mobile phone usage and cell site analysis. However, as is known it is only fairly recently that LTE enabled smartphones have been launched. An LTE investigative approach to considering a particular device used in a particular case requires identification of handsets, dongles and server devices. Moreover, identification of devices that switch between transmission technologies is also a must.

Orange and Vodka - mixing mobile networks (shaken, not stirred) -
http://trewmte.blogspot.co.uk/2010/05/orange-and-vodka-mixing-mobile-networks.html

Examination Techniques3: Blackberry Bold -
http://trewmte.blogspot.co.uk/2012/03/examination-techniques3-blackberry-bold.html

Diplomas: Mobile Telephone Evidence (MTEdipl) -
http://trewmte.blogspot.co.uk/2010/05/diplomas-mobile-telephone-evidence.html