HOS Specification: Test and measurement of mobile phone denial of service installations

Transcription

1 HOS Specification: Test and measurement of mobile phone denial of service installations 1. Background Since 2008 NOMS Security Group (MoJ) have been trialling denial of service equipment within prisons across England. CAST have worked with NOMS, Ofcom and the Mobile Network Operators to produce agreed specifications for such systems. This work has resulted in the publication of several technical specifications that are now the technical annexes for the Prisons (Interference with Wireless Telegraphy) Act This project is concerned with the measurement of out of band/spurious emissions from blockers and also the measurement of the external network (for all denial of service equipment) to establish whether a system meets the proposed technical specification. 2. Measurements required Laboratory based tests Tests to be completed in the Laboratory using various RF equipment to measure the out of band and spurious emissions produced by a blocker. Tests to be completed within a shielded environment as the blocker transmit within licensed RF bands. Prison surveys Prison surveys would need to be completed at prison sites. Involve a number of walk/drive tests around the perimeter and within all publicly accessible areas within 100m of the perimeter. Tests will include measurement of interference to the BCCH on GSM for blockers. Tests for grabber technologies will be completed using test handsets for each network but will need to determine particular identifiers used by the installed system (i.e. Cell ID, LAC). In addition, for all technologies, a number of UE tests for each network and technology within the bounds detailed above. Prison survey tests will be completed with the system on and off within a period of 24 hours to allow comparisons to be made. 1

2 4. Site preparation It is expected that the proposed sites for testing will be in areas that we do not have extensive details with regard to the terrain and access. Site preparation would include the preparation of geo referenced maps, a planned route for both vehicle and walk tests. This preparation may also include contingency for varying weather conditions and considerations for the level of testing. 5. Methodology For lab tests, see Annex A. For site surveys, see Annex B 6. Working with CAST The successful bidder would be expected to work very closely with CAST. Due to the sensitive nature of the work expected that CAST staff would work alongside the contractor during tests. This will also assist with the development of CAST s own capability. It is expected that many of the measurements made within this proposed study will be used to validate equipment and methods at CAST. To this end, it is proposed that the contractor should provide data on appropriate measurements as and when required. 9. Timescales 29 th September 2014 Closing date for proposals WC 13 October 2014 Shortlist 17 October 2014 Contract award 10. How to apply Bids must be submitted as documents comprising a description of the proposed work under the following headings:- Technical team, expertise Bidders must highlight relevant skills and expertise of conducting mobile phone Quality of Service (QoS) measurements. Bidders are encouraged to include reference to any published material. 2

3 Project costs Bidders must provide a clear summary of the project finances. This must include a full breakdown of costs with justification. 11. Selection criteria Bids will be assessed against the following criteria: 1. Project/delivery plan 2. Risk management 3. Handling of sensitive data. (Ideally the potential bidder should have SC clearance or be willing to be SC cleared) 4. Successful delivery of similar projects 5. Relevant expertise and skills in measurement of mobile phone networks and testing of wideband RF spectrum using signal analysers. 6. Cost of project Queries must be submitted to HOSProcurement@homeoffice.gsi.gov.uk quoting HOS/14/014 in the subject line by 22 nd September Bids must be submitted to HOSProcurement@homeoffice.gsi.gov.uk by 29 th September quoting HOS in the subject line. This contract awarded will be subject to Home Office Standard Terms and Conditions. 3

4 Annex A Overview This measurement process has been developed to assess the emissions in the nonblocking bands from radio frequency interfering equipment that is installed in prisons. It is expected that the equipment may produce radio frequency emissions outside of the intended bands. It is the purpose of this document to define a test method and specify limit values to which the equipment must comply, in order to be fit for purpose. The limit values are derived from the relevant reference documents for Base Stations published by the European Telecommunications Standards Institute (ETSI). 4

5 The Radio Frequency Bands Definition The mobile phone frequency bands are summarised in Table 1 Band Frequency Coverage (MHz) UL (UE) DL (BS) Table 1 Mobile Phone Frequency Bands Any Radio Frequency (RF) power emitted outside the mobile phone downlink bands, as defined in Table 1, will be considered as out of band emissions. A summary diagram of the intended emission bands and the adjacent frequency bands is given in Figure GSMR Blocked Band Aeronautical Bs>Ms CAA/MOD Earth Space DECT Earth-Space IMT satellite

6 Figure 1 Mobile Phone and Adjacent Frequency Bands 6

7 RF Emissions Measurement Requirements Adjacent to the mobile phone down link frequency bands Spurious emissions from the equipment should be the same as a wide band (i.e. 20MHz) LTE channel positioned 10 MHz from the edge of the blocking band. In the 800, 900 and 1800MHz bands, the power from the equipment in the frequency regions close to the edge of the blocking bands should be in accordance with Table of TS ; copied here below. Table 2 - Band Edge Requirement for 800 MHz, 900 MHz and 1800 MHz bands In the 2100 and 2600MHz band, the power from the equipment in the frequency regions close to the edge of the blocking bands should be in accordance with Table of TS ; copied here below. Table 3 - Band Edge Requirement for 2100 MHz and 2600 MHz band 1 ETSI TS V9.1.0 ( ) Technical Specification LTE; Evolved Universal Terrestrial Radio Access (E-UTRA); Base Station (BS) radio transmission and reception 7

8 Note from Paragraph of TS F offset = is the separation between the channel edge frequency and the centre of the measurement filter. 2 In the mobile phone up link frequency bands The equipment shall not emit any significant power in the uplink (mobile to base) bands: GSM-R, 800, 900, and 1800MHz bands including DECT guard bands and also the UMTS TDD frequency. The requirement is given in Table of ETSI TS , BS spurious emissions limits for E-UTRA BS for co-existence with systems operating in other frequency bands. 2 The UMTS specification TS has a different definition of Foffset 8

9 Frequency Band Limit Value Measurement Bandwidth MHz -61 dbm 100 KHz MHz -61 dbm 100 KHz MHz -52 dbm 1 MHz MHz -49 dbm 1 MHz MHz -49dBm 1MHz Table 4 - Emission Limits in FDD uplink frequency bands At all other frequency bands At all other frequencies the limit value for the non-blocking band emissions is given in CEPT Recommendation Recommends (3) gives the measurement range: 30 MHz to MHz Recommends (4) gives the measurement bandwidths: 100 KHz between 30MHz and 1 GHz and 1MHz above 1 GHz Table 2.1 of CEPT gives spurious domain limits for the land mobile service. For receivers and transmitters in idle mode, the spurious domain limit is -57 dbm/100khz for frequencies less than 1GHz, and -47dBm/MHz for frequencies above 1GHz. 3 CEPT/ERC/RECOMMENDATION 74-01E (Siófok 98, Nice 99, Sesimbra 02, Hradec Kralove 05), Unwanted Emissions in the Spurious Domain 9

10 Guidance In order to record the emitted signals from the interfering equipment, the equipment setup shown in Figure 2 should be used. Attenuator Equipment under Test Spectrum Analyser Distribution Amplifier Equipment Figure 2 - Outline Test Set Up The attenuator may be adjusted so that in band signals appear at the top of the analyser display, this will give the best dynamic range The test requirement may be referred to the antenna input. A correction may be applied to determine the signal level at the antenna input as indicated in Equation 1 below. Signal Level at Antenna Input = Measured Signal Level + Fixed attenuator between PA output and Spectrum Analyser input 10

11 - Installed fixed losses between PA output antenna input Equation 1 In the case of measurements of emissions at the edge of the blocking bands in accordance with paragraph 0 ; plots are recommended over the range from 5 MHz within the blocking band to 15 MHz outside the blocking band. The spectral plots required are given in Table 5. Frequency Band Measurement Bandwidth KHz KHz MHz MHz MHz 30 KHz MHz 30 KHz MHz 1 MHz MHz 1 MHz MHz 30 KHz MHz 30 KHz MHz 1 MHz MHz 1 MHz MHz 100 KHz MHz 100 KHz KHz KHz Table 5 - Plots required of band edge spectrums 11

12 Measured values of signal power at 500 KHz intervals, measured within the specified bandwidth and with corrections applied according to Table 5 should be compared with the limit values given in Paragraph 0. Further to this, spectral plots will be required to demonstrate power in the mobile phone up link frequency bands in accordance with Paragraph 0 and at all other frequencies in accordance with Paragraph 0 For all measurements, the equipment output power should be the maximum value according to the intended installation and the fixed losses in Equation 1 should be the minimum value according to the intended installation. If it is assumed that the blocking signal is swept in some fashion across the blocking band, then the blocking signal and the measurement window will only align intermittently. Therefore, in all cases the spectrum analyser should be configured with a sufficiently slow sweep speed to ensure the full equipment power is captured. Anticipating that the interference may not have a steady state value, a measurement of peak power is required. Average power can be measured if the interference has a steady state value. This is reasonable if we suppose that the interfering signal repeatedly sweeps across the intended frequency band such that the equipment power in one channel does not have a steady state value. 12

13 Annex B 1 Overview This measurement process has been developed for the National Offender Management Service in agreement with the Mobile Network Operators. The measurement process has been developed to assess the impact of equipment designed to stop the operation of mobile phones within prisons. The objective of the measurements is to demonstrate that where such equipment is deployed inside a prison it has little effect on the cellular networks outside that prison. In general the levels of mobile network coverage will be different around each prison site and as such the impact of leakage from interfering equipment will vary from site to site. The procedure described in this document will therefore be applied to every deployment of fixed equipment. The deployment of portable equipment is subject to a different protocol. Just before the interfering system is first commissioned, supplier validation measurements are completed. Following the supplier validation measurements, the independent verification tests described in this document shall be performed twice, once with the blocking equipment inactive and once with the equipment active. This dual testing will allow a comparative assessment of the effects of signal leakage from the interfering equipment on the performance of the mobile network. The deployment of two types of fixed equipment is covered by this method statement. The two types of equipment are: Blockers, which transmit a jamming signal on the downlink so that mobiles cannot demodulate signals from the genuine mobile phone networks. Grabbers, which are devices designed to appear to the mobile like a part of the real network. If the mobile connects to the grabber, it is not then able to connect to the real network. The measurements described in this document should be performed; When the system is first commissioned and subsequently if and when the system is updated or changed significantly At, or around, the first anniversary of the installation. If the first anniversary measurement campaign shows no changes from initial measurement, additional subsequent measurements should be performed every five years. If there are significant changes, then the anniversary measurement report will identify a specific re-test regime. Additional ad-hoc measurement campaigns may be required should mobile operator networks change significantly in the area outside the prison 4. 4 An example of a significant change would be the decommissioning of cell sites such that the coverage level in the area around the prison is reduced. 13

14 2 Measurement Methods The objective of the tests described in this Method Statement is to demonstrate that emissions from equipments installed in prisons do not cause unacceptable detriment to the mobile operators service quality in the areas surrounding the prison. The assessment criteria were agreed with the Mobile Network Operators (MNOs) in July and this protocol takes into account additional comments from the MNOs in December and June Any other information gathered but not presented in the network assessment report shall be made available upon request. The time scales for any testing undertaken shall be communicated to the MNOs in advance, so that they may undertake their own testing. Contact details for the MNOs are given in Annex C. Testing shall be conducted in all publicly accessible areas, including roads and footpaths that are between m outside the prison perimeter and shall be repeated for all networks, technologies and equipment activity states as described in this Method Statement. Test receivers shall be fully representative of a hand held mobile phone. The antenna height of the test receiver shall be approximately 1.5m above local ground. Where appropriate, a portion of the test calls and measurements of network quality should be made at heights greater than 1.5m in locations that are not subject to private ownership and where mobile customers could reasonably be expected to be using a mobile device. The testing shall be conducted twice, initially with the equipment inactive to obtain the ambient data and then repeated with the equipment active. Tests shall be undertaken within 24 hours to minimise the possibility of network configuration changes (e.g. traffic loading, reconfiguration, weather) influencing the results. All tests shall be repeated with the same route, direction and antenna orientation. A report shall present quantitative analysis of network quality (in the case of blockers only) and call success statistics, details of which are provided in this document. The primary aim is to demonstrate how the installation meets the requirements stated in this Method Statement. 5 Minutes of meeting between Ofcom, HMPS, Home Office And MNOs, July Meeting between Ofcom, MoJ, Home Office and MNOs, December Meeting between Ofcom, MoJ, Affini and MNOs, June 10,

15 Where the method calls for a presentation of results on a map, positional data shall be determined automatically either using GPS or an alternative method with a similar degree of accuracy. All data shall be recorded and available for a minimum of 5 years from the date of test. The mobile operating bands listed in Annex 1 are technology neutral. 2G, 3G and 4G technologies are simultaneously operating in the 900MHz and 1800MHz mobile bands. For these bands, and whilst this remains the case, it is sufficient to perform the tests in the paragraphs below with respect to GSM operation. 2.1 Acceptance Criteria Individual verification tests are as described in the following paragraphs. A different set of measurements is applicable to blockers and grabbers as they operate in a different manner. GSM Network Quality Measurements (paragraph 2.2) apply only to blockers and where the frequency band of interest has GSM networks in operation in the area around the prison. Neighbour Cell Measurements (paragraph 2.5) apply only to grabbers. Acceptance will be based on the results of call success rates (paragraph 2.4) and, where applicable, GSM Network Quality Measurements (paragraph 2.2). 2.2 GSM Network Quality Measurements Network Quality Analysis is applicable to equipments operating in frequency bands where GSM networks are in operation. Data shall be recorded to confirm that the area or sample count where a GSM C/I of 9 db, for each network operator and frequency band, is maintained degrades by less than 5% when the blocker is active The impact of the equipment leakage shall be assessed by measuring C/I in the BCCH. Where C/I measurements are not achievable, RXQUAL 8 = 0 or 1 may be presented as a substitute for C/I > 9dB. A sufficient quantity of data shall be recorded to ensure that the results are statistically valid. It is expected that this will be greater than 1000 individual spatially separated samples (after duplicated 9 data from the same location has been 8 RXQUAL = 0 corresponds to <0.2% BER and RXQUAL = 1 corresponds to 0.2% to 0.4% BER. These levels generally imply no degradation in user experience. 9 For example, the test vehicle may be static, which may result in more than one measurement taken from the same location. 15

16 removed) for each operator and frequency band. Data samples should be as evenly spaced out within the test area as is practicable. Acceptance shall be based on a maximum decrease in the proportion of satisfactory samples of 5%. That is: and: A satisfactory network sample is one where C/I > 9dB or RXQUAL = 0 or 1. The acceptance criterion applies individually in each frequency band, for each technology and for each MNO. For each operator network and frequency band (Annex 1) and with the equipment active and inactive, network quality measurements shall be presented by a map showing C/I (or RX QUAL) for 2G. 2.3 Ec/Io Measurements Ec/Io Analysis is applicable to equipments operating in frequency bands where 3G networks are in operation. This data will be recorded and made available on request. For 3G networks the impact of the system leakage shall be assessed by measurement of call success statistics as detailed in Section 2.4, for each operator network and frequency band (Annex A) and with the equipment active and inactive. 2.4 Measurement of Call Success Statistics Call success statistics are applicable to all frequency bands that contain networks that can be used to set up voice calls. Test handsets shall be used to record the volume of calls that are successful or unsuccessful in the area outside the prison perimeter. For each operator network and frequency band; unsuccessful calls when the equipment is inactive and when the equipment is active shall be displayed on separate maps. 16

17 For each operator network and frequency band; test call results shall also be presented in separate tables showing the call success rates with the blocker inactive and active. To enable a comparative measure of the effect of the equipment, one table shall be presented for each operator, technology and frequency band. A sufficient quantity of data shall be recorded to ensure that the results are statistically valid. It is expected that this will be greater than 1000 individual spatially separated samples (after duplicated data from the same location has been removed) for each operator and frequency band. Test calls should be as evenly spaced out within the test area as practicable. Acceptance shall be based on a maximum decrease in the call success rate of 5%. That is successful and The acceptance criterion applies individually in each frequency band, for each technology and for each MNO. For each operator network and frequency band (Annex A) and with the equipment active and inactive, call fail/success shall be presented on a snail trail map showing successful and unsuccessful calls. 2.5 Neighbour Cell Measurements The spoof cells of grabber systems are commonly (but not always) designed to appear to mobiles as genuine neighbour cells with unique identifiers (e.g. Cell ID, ARFCN, LAC etc). Where grabber cells do appear in the neighbour list, mobiles operating outside the prison may detect the grabber cell during the normal neighbour cell measurement cycle. Analysis of the measurements taken during call success evaluation with test handsets is required to identify whether any neighbour cell measurements correspond to measurements on the grabber cell. In order to distinguish the grabber from a genuine cell, tests will be conducted to determine where the unique identifiers of the installed equipment are visible to the test handset and these areas will be highlighted on a map of the area. 17

18 For each operator, frequency band and network for which grabber cells have been implemented, neighbour cell measurements shall be analysed using the same route used to assess call success statistics. A map shall be presented identifying where the grabber cells unique identifier(s) is/are visible. It is recommended, though not mandatory, to use the following three colour scheme: Green. The unique identifier of the grabber is not reported in neighbour cell measurements Orange. The unique identifier is reported in neighbour cell measurements, but below the level of the serving cell. Red. The unique identifier is reported as the strongest signal in neighbour cell measurements. 2.6 Signal Strength Measurements Measurements will be conducted around the site where the public have unrestricted access. Locations of these tests should be accurately displayed on a map of the site. For each operator network and frequency band (Annex 1) and with the equipment active and inactive, signal level measurements shall be presented by a map showing the signal level. For GSM signal strength means the receive level of the serving cell BCCH channel. For 3G UMTS signal strength means the level of the serving cell pilot channel P- CPICH and for 4G LTE signal strength means the level of the Primary Synchronisation Signal, PSS. Some guidance on measurements is given in Annex 2. For each operator network and frequency band (Annex 1) and with the equipment active and inactive, signal strength shall be presented by a map showing the recorded signal level. 3 Site Access In order to facilitate measurements, access will be required to the external perimeter roadway and all other surrounding areas external to the main prison perimeter wall. If measurements are anticipated within the prison; the prison manger should be advised so that external dog units patrolling the perimeter line can be made aware. 18

19 Annex 1 Mobile Phone down link frequencies in the 800MHz, 900MHz, 1800MHz, 2100MHz and 2600MHz bands are shown below. As of 2013, all frequency bands were liberalised, that is any technology can be placed in any band. All frequencies in the table below are correct on the 14 July 2014, according to UK Cellular Operators frequency tables published by Ofcom. Operator Down Link Frequency Bands (MHz) British Telecommunications Everything Everywhere (T- Mobile and Orange) , , , , Hutchinson 3G UK , , , , , , Telefónica UK (O2) , , , , , Vodafone , ,

20 Annex 2 - Guidance Network Quality Analysis The testing will be conducted with an industry standard air interface analysis package (e.g. TEMS investigation, NEMO Outdoor etc) with a 2G test MS and 3G test UE operating in dedicated mode. Signal Strength Measurements The preferred method to obtain signal strength measurements is from air interface analysis packages such as those noted above. Signal strength measurements using a test receiver or a spectrum analyser are likely to be swamped by signals from the surrounding serving cells, and in practice it may be difficult to distinguish interference from the blocker or grabber from signals from the serving and neighbour cells. It is expected that as part of the system design, installation and commissioning, the system supplier will have conducted validation measurements, for example, using CW sources on clean channels or guard band channels. Such measurements do not, however, form part of the verification measurements described in this document. 20