Advanced Security and Mobile Networks

Transcription

1 Advanced Security and Mobile Networks W.Buchanan (1)

2 GSM/3G Technology The most important mobile network Software Security W.Buchanan (2)

3 First generation (1G). First generation mobile phones (1G) had very low transmission rates (typically just a few KB/s), Second generation (2G and 2.5G). These are devices improved this to give several hundred KB/s. Third generation (3G). These devices give almost workstation network bandwidths (several MBps), which allows for full multimedia transmissions. Mobile phone technology W.Buchanan (3)

4 POTS POTS (Plain (Plain Old Old Telephone Telephone System) System) GSM GSM network GSM GSM gateway Internet W.Buchanan (4)

5 2 1 2 If we wish to setup radio transmitters how many different radio frequencies do we need? W.Buchanan (5)

6 2 1 2 Mobile device will continually scan for other frequencies, even when it connects to one (in this case, frequency 3) Sometimes there must be a handover between two cells, if a user moves from one to another, and is still in a call. W.Buchanan (6)

7 GSM-900 (900MHz) Dual-band phones 3G GHz GSM-1800 (1.8GHz, non-us) Known as DCS GSM-1900 (1.9GHz, US) Known as PCS GSM uses a mixture Of TDMA (Time-Division Multiple Access) and FDMA (Frequency-Division Multiple Access) TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 Control Call 3 Call 1 Channel 1 500ms TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 Control Call 2 Channel GSM-900, GSM-1800 TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 T-Mobile: GSM-1800 Control Call 4 Orange: GSM-900 Vodaphone: GSM-900, GSM : UMTS (3G) Network Channel (for GSM-900) Sitefinder: W.Buchanan (7)

8 Time slot 62.5 ms Call 1 Speech burst is compressed and inserted into the time slot Mobile phone networks use RPE/LTP (Regular Pulse Excitation/ Long Term Prediction) - which reduces the normal rate from 64kbps to between 7 and 13 kbps. W.Buchanan (8)

9 24.8 MHz khz GSM-900 GSM-900 (900MHz) (900MHz) TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 Control Call 3 Call 1 Control Call 3 Call 1 Call 1 Call 3 MUX A specific timeslot is reserved for the call on a specific channel DEMUX Call 1 Call 3 W.Buchanan (9)

10 Each time slot allows 9.6kbps GSM-900 GSM-900 (900MHz) (900MHz) TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 Control Call 3 Call 1 Control Call 3 Call 1 Call 1 Call 3 MUX A specific timeslot is reserved for the call on a specific channel DEMUX Call 1 Call 3 W.Buchanan (10)

11 More than one slot can be reserved (such as 38.4kbps for 4 slots) High-Speed High-Speed Circuit Circuit Switched Switched Data Data (HSCSD) (HSCSD) TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 Control Call 1 Control Call 3 Call 1 Call 1 Call 3 MUX A specific timeslot is reserved for the call on a specific channel DEMUX Call 1 Call 3 W.Buchanan (11)

12 Up to 8 time slots can be reserved for the data packets (~100kbps) General General Packet Packet Radio Radio Switch Switch (GPRS) (GPRS)- -uses Packet Packet switching switching rather rather than than Circuit Circuit switching switching TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 TS0 TS1 TS2 TS3 TS4 TS5 TS6 TS7 Control Control Call 3 Call 1 Call 1 Call 3 MUX A specific timeslot is reserved for the call on a specific channel DEMUX Call 1 Call 3 W.Buchanan (12)

13 Mobile Phone Cells/Masts There s one near you! Hopefully Software Security W.Buchanan (13)

14 From a uni-directional mast the radio power radiates outwards, evenly Power transmitted is typically defined in dbw: 20dBW is 100 W 25dbW is 316 W 30dBW is 1kW (Power of a microwave oven) Power Transmitted W.Buchanan (14)

15 Orange/Hutchison T-Mobile mast Blackford Hill in Edinburgh is an excellent area for radio communications. Antenna Mast on Blackford Hill W.Buchanan (15)

16 Operator Vodafone Operator Site Ref. 221 Antenna Height 22 m Frequency 900 MHz Transmitter Power dbw Maximum power 32 dbw Type GSM 20dBW is 100 W 30dBW is 1kW Operator Hutchison Operator Site Ref. EH0071 Antenna Height 23 m Frequency 2100 MHz Transmitter Power 25.5 dbw Maximum power 32 dbw Type UMTS Operator T-MOBILE Operator Site Ref Antenna Height 30 m Frequency 1800 MHz Transmitter Power 26 dbw Maximum power 32 dbw Type GSM W.Buchanan (16)

17 Orange mast O2 mast Glenlockhart Hill (near Craiglockhart Campus) in Edinburgh is also another excellent area for radio communications. W.Buchanan (17)

18 Operator MMO2 Operator Site Ref Antenna Height 23 m Frequency 900 MHz Transmitter Power 20 dbw Maximum power 32 dbw Type GSM Operator Orange Operator Site Ref. LOT0106 Antenna Height 25 m Frequency 1800 MHz Transmitter Power 23.7 dbw Maximum power 32 dbw Type GSM W.Buchanan (18)

19 Tynecastle Stadium offers a local high-point around Gorgie. Antenna Mast at Tynecastle Stadium W.Buchanan (19)

20 Operator Vodafone Operator Site Ref Antenna Height 29 m Frequency 900 MHz Transmitter Power dbw Maximum power 32 dbw Type GSM Operator Operator Site Ref. Antenna Height Frequency Transmitter Power Maximum power Type Operator Operator Site Ref. Antenna Height Frequency Transmitter Power Maximum power Type Orange LOT m 1800 MHz 22.5 dbw 32 dbw GSM Hutchison EH m 2100 MHz 26.2 dbw 32 dbw UMTS Antenna Mast at Tynecastle Stadium W.Buchanan (20)

21 3G Mast on Blackford Avenue 3G antenna Pico cell Operator Operator Site Ref. Antenna Height Frequency Transmitter Power Maximum power Type Hutchison EH m 2100 MHz 26.2 dbw 32 dbw UMTS Operator MMO2 Operator Site Ref Antenna Height 22 m Frequency 900 MHz Transmitter Power 25 dbw Maximum licensed power 32 dbw Type GSM Power supply and electronics 3G antenna on Blackford Avenue W.Buchanan (21)

22 3G Mast on Comiston Road Pico cell 3G antenna Operator Operator Site Ref. Antenna Height Frequency Transmitter Power Maximum power Type Hutchison EH m 2100 MHz 26.2 dbw 32 dbw UMTS Power supply and electronics 3G antenna on Comiston Road W.Buchanan (22)

23 Hutchison EH m 2100 MHz 26.2 dbw 32 dbw UMTS Operator Operator Site Ref. Antenna Height Frequency Transmitter Power Maximum power Type W.Buchanan (23)

24 Cell Name Greenbank CSR Type 900 MACRO Cell Name: Edinburgh Dalry CSR: Type: 900 MACRO Cell Name: Murrayfield Stadium CSR: Typ: 900 PICO Ref: Cell name: Morningside North CSR: Type: 900 MACRO Cell name: Merchiston South CSR: Type: 900 MACRO Cell name: Gorgie East CSR: Type: 900 MACRO MM O2 network around Edinburgh W.Buchanan (24)

25 Cell name:murrayfield CSR: Cell type: 900 MACRO 1800 MACRO Ref: Cell name: Blackford Hill CSR: Cell type: 900 MACRO 1800 MACRO MM O2 network around Edinburgh W.Buchanan (25)

26 Mobile-phone based Location Services The next big thing? Software Security W.Buchanan (26)

27 Tracking government employees Emergency service tracking Tracking Service Personnel Inventory tracking Transport tracking Location-tracking services Location-tracking services W.Buchanan (27)

28 Curlup-n-Dye Cupa-Now? Computer-Hack Thirsty? Buy A nice latté You need a Haircut! When not try a new wireless card? Location-based advertising These technologies are based on push services where information is pushed to the user, rather than them requesting it. Location-based Advertising W.Buchanan (28)

29 Road Tolls Parking Travel costs Location-based sales Location-based Sales W.Buchanan (29)

30 GPS (Global Positioning System), Cell-ID (Cell Identity), AOA (Angle of Arrival), TOA (Time-of-arrival), OTD (Observed Time Difference), A-GPS (Assisted Global Positioning System), E-OTD (Enhanced - Observed Time Difference). Methods used for Location-finding in Mobile Phones W.Buchanan (30)

31 Handset Network Position Calc Function Position (x,y) Assistance Position (x,y) Handset-based mode Assistance Measurement Position Calc Function Handset-assisted mode Handset-based or Handset-assisted Position (x,y) W.Buchanan (31)

32 Many accurate location finding services are based on triangulation r 1 a 2,b 2 a 1,b 1 r 2 I am r 1 away from a 1, b 1 I am r 2 away from a 2, b 2 I am r 3 away from a 3, b 3 By drawing circles, we can find the position a 3,b 3 r 3 Triangulation W.Buchanan (32)

33 (6,8) (14,8) (10,0) For example if I am 5 metres away from each of these points. Where am I? Triangulation W.Buchanan (33)

34 (6,8) (14,8) (10,0) This point should be (10,5) Triangulation W.Buchanan (34)

35 Triangulation It is extremely accurate, but it also has limited coverage in urban areas, especially within buildings or near obstructions. As an alternative, mobile phone-based location-finding is an inexpensive method for location-finding, as it has wide-scale coverage, along with inexpensive handsets Global Positioning System (GPS) W.Buchanan (35)

36 Mast Mast cells Mast-based determines nearest mast Cell-ID (with omni-directional cells) W.Buchanan (36)

37 The accuracy depends on the density of mast. From a few metres To many km s in rural areas. Around Edinburgh the accuracy would be reasonable, in the Borders, not so good. Cell-ID (with sectored cells) W.Buchanan (37)

38 Signal strength is measured against a known propagation pattern Or The time taken for the signals to arrive are measured Enhanced Cell-ID W.Buchanan (38)

39 Mast Mast cells Measurement of time delay TOA (Time of Arrival) W.Buchanan (39)

40 Measurement of angle Angle-of-Arrival (AOA) W.Buchanan (40)

41 A-GPS is also a time-based technique in which the handset measures the arrival time of signals transmitted from three or more GPS satellites. In general, the information decoded by the GPS receiver from the satellites is transmitted to the handset through the radio network, bringing improvements for the time-to-first-fix (which is the initial time for the first location measurement) and battery life as the handset no longer needs to search for and decode the signals from each available satellite. Removing the need to decode the satellite signals also enables detection and TOA estimation, which allows it to provide position estimates under foliage, within cars, in most outside environments, and many indoor environments. Assisted-GPS (A-GPS) W.Buchanan (41)

42 TOA works by the handset bouncing a signal back off the base stations, or vice-versa. Since radio waves travel at the speed of light (c), the distance (d) between the handset and base station can be estimated from the transmission delay, that is, half the time delay between transmitting and receiving the signal. This, however, locates the handset as being on a circle with a radius d, with the base station at the centre of the circle. If the estimate is made from three base stations, there will be three circles that intersect at the handset, as shown in the figure. TDOA technique is time-based and quite similar to TOA. It works by either measuring the relative arrival time in the handset of signals transmitted from three base stations at the same time; or measuring relative arrival time transmitted by the handset at three base stations. The difference of arrival time defines a hyperbola, with the loci at the two base stations. As three base stations are used, there are three sets of time differences which creates three hyperbolic equations that define a single solution. Time-of-Arrival (TOA)/Time Difference of Arrival (TDOA) W.Buchanan (42)

43 Mobile-phone based Location Experiment Borders, Scotland? W.Buchanan (43)

44 Name: Ancrum ID: Type: 900 MACRO Name: Eildon ID: Type: 900 MACRO Name: Dalcove ID: Type: 900 MACRO W.Buchanan (44)

45 The radio interface in GSM uses a combination between frequency (FDMA) and time (TDMA) multiplexing. The frequency division in GSM 900 allocates 125 frequencies in each direction for GSM. The basic parameters are: Uplink frequencies are between 890 and 915MHz. Downlink frequencies are between 935 and 960MHz. Carrier frequencies are separated with 200 khz on each side. These frequencies are allocated in pairs, so that each uplink/downlink pair is separated with exactly 45 MHz. Each of the carrier frequencies are divided into eight logical channels, using TDMA, and a TDMA frame contains one time-frame from each of the eight channels, and lasts ms. Time-frames from each channel lasts ms. Total bit-rate for all eight channels is kbps, whereas the bit-rate for each channel is 22.8 kbps. Experimental Details W.Buchanan (45)

46 Example of masts in the Scottish Borders. It can be seen that each mast is identified with a different Cell-ID. These Have a different broadcast frequency and channel (BCCH). No two adjacent cells have the same BCCH. Practical Example of Cells W.Buchanan (46)

47 Conclusions After the success of SMS, the network providers are looking for another big revenue generator that does not require too much bandwidth. Location-services could provide this. The key things that must be overcome are: - Accuracy. - Compatibility. - Security. Users must subscribe to the services, as they will not trusts ones which allow other users to track them without their knowledge. - Distrust. Currently many users distrust mobile phones. - Integration with applications. W.Buchanan (47)