Use of GSM Logical Channels for CSA

When a mobile/smart phone's power button is pressed the mobile triggers the power up sequence. The mobile station MS is in the radio darkness (ignorant) at this stage about the radio coverage that surrounds it in the geographical area in which it has been switched ON. Once switched on, the mobile device will seek to establish, using the embedded routines in its radio program that will enable it to follow a sequence that brings it out of the radio darkness and into the radio light. It gains knowledge about the radio coverage surrounding it; makes comparison of particular coverage to identify the correct transmission technology for which the mobile device has been designed and manufactured; illuminate its presence to the mobile network in the geogrpahical location where it is dwelling for the purpose of communications; to be radio link-enabled for mobile content communications and radio link-disabled to terminate mobile content communications. 

The diagram below omits 'timing' of events because it is not there to demonstrate the time when each event occurs but it is intended the diagram to offer an at-a-glance visual indication of the sequence of channels involved from power ON to terminating a call.

It is possible that a suggestion could be raised that the above diagram is not entirely realistic because following power and registering with the network what happens if there is an incoming call indicator that is received or immediately following power up and registering with the network an SMS is received? In GSM terms it is possible to select the use of the channels identified above for each of those purposes. So the diagram can be considered for use relating to incoming and/or outgoing communications

For the avoidance of doubt regarding GSM logical channels, it is relevant to mention that under the logical allocation of channels there is a separate and divided appraoch to two logical channel paths, if you will: 'Common Channels (CCH)' and 'Dedicated Channels (DCH)'.

Commons Channels (CCH)
CCH has allocated under it two channel sub-divisions:

Broadcast Channels (BCH) which is divided into a further three sub-channels:

- Frequency Control Channel (FCCH); Synchronisation Channel  (SCH); Broadcast Control Channel (BCCH).

Common Control Channels (CCCH) which is divided into a further three sub-channels:

- Paging Channel (PCH); Random Access Control Channel (RACH);  Access Grant Channel (AGCH)


Dedicated Channel (DCH)
DCH has allocated under it two channel sub-divisions.

Common Channels (CH) which is divided into a further three sub-channels groups:

- Stand-alone Dedicated Control Channel (SDCCH); Slow Associated Control Channel (SACCH) ; Fast Associated Control Channel (FACCH)

Traffic Channels (TCH) which is divided into a further two sub-channels:

- Traffic Channel Full (TCH/F) Rate; Traffic Channel Half (TCH/H) Rate 

As a further point to note two DCH logicals channels are shown in the above diagram that are able to be included (transmitted) either in Common Channels communications and/or Traffic Channel communications.  The SACCH has been highlighted because its content can be communicated included in the SDCCH or TCH transmission.

Question1: Do you know the important content that is transmitted in the SACCH packet and its relevance to informing the MS and Network and to cell site analysis?

Question2:  The other DCH logical channel shared has bot been highlighted. Do you know what that other channel is and the important content it holds in the communications informing the MS and Network and to cell site analysis? To refresh its content can too can be communicated included in the SDCCH or TCH transmission.

The Diagram
The diagram above is divided into FOUR separate MS states:

- Power On
- Idle Mode
- Dedicated Mode
- Idle Mode

Each of these separate elements are paramount to GSM CSA and without their basic existence GSM CSA would not be possible from the mobile device element investigation point of view that forms one of the investigation procedures during CSA.

Signal Strength and Distance

Signal Strength and Distance

Reading an article on Susan Brenner's blog lay-testimony-on-cell-phone-radio-waves  about the case U.S. v. Kale, 2011 WL 4361531 (U.S. Court of Appeals for the 3d Circuit 2011) I read with interest the comments of the network operator's lay witness, in the article, recorded as having stated:

" Jeff Strohm, a custodian of records at Sprint Nextel Communications (Sprint), testified that Kale's cell phone used signals from a cell tower located in Pennsauken, New Jersey, and that `the biggest indicator’ of which tower has the strongest signal is `distance.’ "

" Jeff Strohm explained that a “cell phone is constantly searching for the strongest signal” and that the strongest signal is usually determined by `how far away you are from the cell phone tower.’ "

If one is speaking very, very generally to school children or novices etc where those people learning the information are hardly going to make a decision upon learning that info, may well be sufficient, but as influencing testimony for a criminal trial? Is that really enough to provide low-level of information that may be used to decide someone's innocence or guilt?  It is important to enter the caveat that other things may have been said by this witness or other material looked at, but this is the only info included in the article and, thus, by omission of any other info the discussion is based upon what is stated in the article.

Technically, when we deal with received signal strength (MS-BTS/BTS-MS) radio engineers - as opposed to back office call record staff - generally consider it to be a composite of three discrete effects:

- path loss
- slow fading
- fast fading

Those discrete effects take no account of and omit other fundamentally important data a mobile phone requires to have received, decoded and understood in order to 'camp on a cell', that is even before the mobile phone is receiving a communication or instructed to communicate.  

'Signal strength' and 'distance' are most certainly not sufficient for either GSM or spread-spectrum transmission technologies such as CDMA or W-CDMA to suggest are the main key factors to determine which Mast will handle a particular mobile phone's communications.

Within the realms of the GSM transmission technology it is made fundamentally clear as part of the mandatory requirements that a mobile phone shall detect 'signal strength', but what use is ranking signal strength in order of merit without understanding issues, such as:

- cell selection algorithm C1?
- cell reselection algorithm C2?
- if the mobile phone fails to decode parameters in 'control channels' e.g. RACH control parameters in the SYS_INFOS BCCH_INFOS 1–4. Is the Cell Barr Access bit = 1 (trace cf: 9D 00 00 & 9F 00 00) or the Access Control Class not equal 0?
- etc?
- And what about BTS capacity and directed retry?

When a mobile phone is engaged in a mobile call then the newtork instructs a mobile phone which Mast to use via control info through eg SDCCH.

Turning to issues associated with distance. If a mobile phone is located in-building, which can have affect on radio signals and latching to a particular Mast; where the landscape surrounding the mobile phone affects radio signals; or the clutter on the landscape affects the radio signals or a combination of any of the aforementioned, distance between MS and BTS gets blown out of the window as a reasonable suggestion in opposition to other matters that ought to be mentioned to a court of law.

As Sprint operates spectrum-spread transmission technology CDMA mobile services and iDEN transmission technology TDMA mobile services, I need to take some care here not to portray, too much, the wrong image of identical scenarios with GSM.

Wiki records Sprint's activities (Sprint_Nextel)
Sprint Nextel Corporation (NYSE: S) is an American telecommunications company based in Overland Park, Kansas. The company owns and operates Sprint, the third largest wireless telecommunications network in the United States, with 52 million customers, behind Verizon Wireless and AT&T Mobility. Sprint Nextel also owns a separate wireless division, Sprint Prepaid Group which offers prepay wireless services as Boost Mobile and Virgin Mobile USA.

Sprint is a global Internet carrier and makes up a portion of the Internet backbone. In the United States, the company is the third largest long distance provider and also owns a majority of Clearwire, which operates the largest wireless broadband network.

The company was renamed in 2005 with the purchase of Nextel Communications by Sprint Corporation. The company continues to operate using two separate wireless network technologies, CDMA and iDEN (for Nextel and some Boost Mobile subscribers). In 2006, the company spun off its local landline telephone business, naming it Embarq (which was subsequently acquired by CenturyTel). In 2009, Sprint reached an agreement to outsource management of its wireless networks to Ericsson.

Sprint Nextel launched its first WiMAX wireless card on December 21, 2008 (the Franklin Wireless u300 broadband card), and the first WiMAX phone available in the United States (the HTC Evo 4G) on June 4, 2010, utilizing its WiMAX technology from Clearwire Corp. A recent Consumer Reports survey tied Sprint with perennial front-runner Verizon Wireless in terms of customer satisfaction, a big improvement over previous years.

Thus, Sprint Nextel is a company with not only good quality indicators, but has outsourced management of its wireless networks to Ericsson, according to Wiki. The latter company (Ericsson) is known for its high technical competence, quality and originality in telecommunications and mobile communications, and adds further gravitas to my discussion that using 'signal strength' and 'distance' are insufficient to suggest that those elements should be used in isolation to other factors how a mobile phone may use a particular Mast. Ericsson, one could say, as an owner of patents, a developer of mobile networks/devices and transmission technology are the expert's expert. I am convinced, therefore, that companies like Sprint Nextel and Ericsson would hardly endorse in isolation to anything else the simplicity of using 'signal strength' and 'distance' as the indicators to inform a court of law about why a mobile phone would use a particular Mast.
       
In the next discussion I shall go further to open up and explore CDMA/TDMA parameters and protocols required for a mobile phone and Mast to connect for communications purposes.

Location Update (LU) and Cell Site Analysis (CSA)

Location Update (LU) and Cell Site Analysis (CSA)

Heine, G; referred to the model "An MS performs LU on several occasions: every time it changes the location area, periodically, when a periodic location update is active, or with IMSI attach/ detach switched on at the time when it is subsequently turned on again."

That statement minimises, thus hides, a considerable body of mobile activity and, importantly, cell site analysis (CSA) suffers when students and practitioners fail to take into account the importance in the depth of knowledge and understanding that is needed to include the important facet of Location Update when conducting CSA. The following may assist students and practitioners with a simplified operational background as to events when Location Update (LU) takes place:

The MS requests a control channel from the BSC. The BTS decodes the CHAN_REQ, calculates the distance MS«BTS (timing advance), and forwards all this information to the BSC. Please note that the CHAN_REQ already indicates which service the MS requests (Location Update, in this case).

After the CHAN_RQD is received and processed, the BSC informs the BTS which channel type and channel number shall be reserved (CHAN_ACT).

The BTS confirms with a CHAN_ACT_ACK that it received and processed the CHAN_ACT.

The BSC sends the IMM_ASS_CMD, which activates the previously reserved channel. The BTS sends this information over an AGCH to the MS. The MS finds “its” IMM_ASS_CMD by means of the request reference, which is already contained in the CHAN_REQ.

Layer 2, the LAPDm connection is activated only now. The MS sends a SABM to the BTS, which (differently from LAPD) already contains data (LOC_UPD_REQ in this case).

The BTS confirms that a LAPDm connection was established by sending an UA message, which repeats the LOC_UPD_REQ.

The BTS passes LOC_UPD_REQ to the BSC. Although this is a transparent MM message, the BSC still processes the LOC_UPD_REQ in parts, because the BSC amongst others, requires the Mobile Station Classmark information. The BSC packs LOC_UPD_REQ, together with the current LAC, and CI into a CL3I message (Attention: the LOC_UPD_REQ from the MS contains the old LAC!) and then sends this within a SCCP CR
message to the MSC. The CR message carries not only the LOC_UPD_REQ to the MSC, but also requests establishment of an SCCP connection.

If the MSC is able to provide the requested SCCP connection,then the CR is answered with a CC. A logical connection from the MS to the MSC/VLR exists from this point in time on. The MSC/VLR answers the LOC_UPD_REQ with an AUTH_REQ This message is conveyed to the BSC via the established SCCP connection.

BSC and BTS transparently forward the AUTH_REQ to the MS. Most important content is the random number parameter (RAND). The MS (more precisely the SIM) calculates the result SRES by feeding RAND and Kj into the algorithm A3, then transparently sends SRES in an AUTH_RSP message to the MSC/VLR. The VLR compares SRES with the value provided by the HLR.

The MSC/VLR switches on ciphering, if the result from the authentication is correct. For this purpose, the MSC/VLR sends information to both, the MS and the BTS.

The BTS extracts its part form the ENCR_CMD message, which is Kc and sends the rest in a CIPH_MOD_CMD message to the MS. The CIPH_MOD_CMD message only contains the information, which cipher algorithm (A5/X) shall be used. The MS confirms, by sending a CIPH_MOD_COM message that ciphering was activated.

If Equipment Check is active, then the MSC/VLR requests the MS to provide its IMEI. This is done in an IDENT_REQ message, which is transparent for the BSS. Please note that the IDENT_REQ message also allows to request the TMSI or the IMSI. The equipment check may be performed at almost any time during the scenario, or in other words, is not tied to this place of the scenario.

The MS transparently transmits its IMEI in an IDENT_RSP message to the MSC/VLR, where it is checked by means of the EIR, whether that equipment is registered stolen or not approved.

The MSC/VLR assigns a TMSI, which is used instead of the IMSI in order to make tracking of subscribers more difficult. TMSI_REAL_CMD is also a transparent message between MSC/VLR and MS. The most important content of this message is the new TMSI. Please note that the assignment of a TMSI may also take place at the end within the LOC_UPD_ACC.

The MS confirms with a TMSI_REAL_COM that the new TMSI was received and stored. If the new TMSI is assigned with a LOC_UPD_ACC, then the TMSI_REAL_COM is obviously sent only after the LOC_UPD_ACC.

Sending of the transparent LOC_UPD_ACC message confirms that the MSC/VLR has stored the new Location Area (LAI). This concludes the Location Update process. The control channel that was occupied on the Air-interface has to be released, after the Location Update scenario has ended. For this purpose, the MSC sends the CLR_CMD message to the BSC. The BSC passes this command in a CHAN_REL to the BTS, which passes it to the MS. By sending a DEACT_SACCH, the BSC requests the BTS to cease sending of SACCH messages (SYS_INFO 5/6).The MS reacts on receiving a CHAN_REL message by sending a DISC (LAPDm).

This requests from the BTS to release its Layer 2 connection. The BTS confirms release of the Layer 2 connection by sending an UA message. Towards the BSC, the BTS confirms release of the Air-interface connection by sending of a REL_IND message. The BSC forwards this acknowledgment in a CLR_CMP to the MSC. The BSC requests the TRX in a RF_CHAN_REL to release the occupied resources on the Air-interface. RLSD requests release of the SCCP resources.

RF_CHAN_REL_ACK confirms release on the Air-interface. RLC confirms release of the SCCP resources.