Use of GSM Logical Channels for CSA

When a mobile/smart phone's power button is pressed the mobile triggers the power up sequence. The mobile station MS is in the radio darkness (ignorant) at this stage about the radio coverage that surrounds it in the geographical area in which it has been switched ON. Once switched on, the mobile device will seek to establish, using the embedded routines in its radio program that will enable it to follow a sequence that brings it out of the radio darkness and into the radio light. It gains knowledge about the radio coverage surrounding it; makes comparison of particular coverage to identify the correct transmission technology for which the mobile device has been designed and manufactured; illuminate its presence to the mobile network in the geogrpahical location where it is dwelling for the purpose of communications; to be radio link-enabled for mobile content communications and radio link-disabled to terminate mobile content communications. 

The diagram below omits 'timing' of events because it is not there to demonstrate the time when each event occurs but it is intended the diagram to offer an at-a-glance visual indication of the sequence of channels involved from power ON to terminating a call.

It is possible that a suggestion could be raised that the above diagram is not entirely realistic because following power and registering with the network what happens if there is an incoming call indicator that is received or immediately following power up and registering with the network an SMS is received? In GSM terms it is possible to select the use of the channels identified above for each of those purposes. So the diagram can be considered for use relating to incoming and/or outgoing communications

For the avoidance of doubt regarding GSM logical channels, it is relevant to mention that under the logical allocation of channels there is a separate and divided appraoch to two logical channel paths, if you will: 'Common Channels (CCH)' and 'Dedicated Channels (DCH)'.

Commons Channels (CCH)
CCH has allocated under it two channel sub-divisions:

Broadcast Channels (BCH) which is divided into a further three sub-channels:

- Frequency Control Channel (FCCH); Synchronisation Channel  (SCH); Broadcast Control Channel (BCCH).

Common Control Channels (CCCH) which is divided into a further three sub-channels:

- Paging Channel (PCH); Random Access Control Channel (RACH);  Access Grant Channel (AGCH)


Dedicated Channel (DCH)
DCH has allocated under it two channel sub-divisions.

Common Channels (CH) which is divided into a further three sub-channels groups:

- Stand-alone Dedicated Control Channel (SDCCH); Slow Associated Control Channel (SACCH) ; Fast Associated Control Channel (FACCH)

Traffic Channels (TCH) which is divided into a further two sub-channels:

- Traffic Channel Full (TCH/F) Rate; Traffic Channel Half (TCH/H) Rate 

As a further point to note two DCH logicals channels are shown in the above diagram that are able to be included (transmitted) either in Common Channels communications and/or Traffic Channel communications.  The SACCH has been highlighted because its content can be communicated included in the SDCCH or TCH transmission.

Question1: Do you know the important content that is transmitted in the SACCH packet and its relevance to informing the MS and Network and to cell site analysis?

Question2:  The other DCH logical channel shared has bot been highlighted. Do you know what that other channel is and the important content it holds in the communications informing the MS and Network and to cell site analysis? To refresh its content can too can be communicated included in the SDCCH or TCH transmission.

The Diagram
The diagram above is divided into FOUR separate MS states:

- Power On
- Idle Mode
- Dedicated Mode
- Idle Mode

Each of these separate elements are paramount to GSM CSA and without their basic existence GSM CSA would not be possible from the mobile device element investigation point of view that forms one of the investigation procedures during CSA.

Examination Techniques3: Blackberry Bold

Examination Techniques3: Blackberry Bold

Examiners may have noticed that the internet is flooded with secret or hack codes that may be entered into a handset and a brief description of the code's purpose. Every make and model seems to have its own codes. One code that has been doing the rounds since 2010 is the Blackberry Bold code for ' Display cause of PDP reject ' relevant to GPRS. Below is list of sample entry codes posted on the internet. As you can see there appears to be some variation in the way the code is expressed it should be entered into a Blackberry:

ALT+JKVV @ Home Screen. Display cause of PDP reject
http://newestblackberryfreeware.com/blackberry-tips-and-tricks/blackberry-secret-codes/

ALT-JKVV Home Screen Display cause of PDP reject
http://forum.mintywhite.com/viewtopic.php?f=9&t=790

ALT-JKVV Home Screen Display cause of PDP reject
http://forums.crackberry.com/archive/index.php?t-78665.html

ALT+JKVV @ Home Screen. Display cause of PDP reject
http://www.xusermanual.com/all-tags/blackberry-bold-3-secret-codes

It is recommended that examiners may wish to consider researching the use of the codes on test handsets prior to conducting 'live' examination on the evidential DUT.

However, a second matter that was apparent from the internet postings that there was no assistance given to the reader or, for that matter, an examiner as to the interpretation of the information (data) that would be displayed on the screen of the DUT as a value or a cause that would be relevant to it (the value).

In order to understand the meaning of the data relevant to ' Display cause of PDP reject ' examiners should at first instance review 3GPP TS24008 / GSM 0408 in order to understand the relevance of PDP with respect to 'Activate PDP Context Reject State ' when it is On and the value given in an ' Activate PDP Context Reject SM Cause '.

Below are several tables compiled with content relevant to PDP reject values and their causes. Whilst I have reviewed standards and other sources to seek agreement of the values and causes, you may wish to check for yourself the accuracy of the information recorded in the tables. The 3GPP/GSM standards have been identified above and to conduct simple Binary/Hex/Decimal conversion readers may wish to visit an online calculator website similar to the one at the following link http://easycalculation.com/binary-converter.php.

GMM Cause Information Element



SM Cause Information Element



SM Cause Information Element on GTP protocol



Whilst the values and causes in the tables above have been identified there is still additional information that the standards identify relevant to each of them. Having said that, being able to investigate these values/causes and trace them to the GSM MS / WCDMA UE and to the network is quite helpful, particularly when dealing with blacklisted handsets or invalid IMSIs. Additionally, the values and causes provide a useful guide when conducting live tests for GPRS cell site analysis.