MicroNet dual band IMSI and IMEI catcher

Transcription

1 MicroNet dual band IMSI and IMEI catcher Datasheet Models: MNG (GSM 900, 1800) MNG (GSM 850, 1900) Document Nr OTK Date: , revision B

2 Table of contents 1. Acronyms and abbreviations 2. Overview 3. Main features 4. Applications and modes of operation 5. List of components 6. Specifications 7. Omni directional antennas 8. Power inverter 9. Notes 2 P a g e

3 1. Acronyms and abbreviations PLMN - Public Land Mobile Network IMSI - The International Mobile Subscriber Identity (IMSI) is an internationally standardized unique number to identify a mobile subscriber. The IMSI is defined in ITU-T Recommendation E.212. The IMSI consists of a Mobile Country Code (MCC), a Mobile Network Code (MNC) and a Mobile Station Identification Number (MSIN). IMEI - The International Mobile Equipment Identity (IMEI) is a unique number used to identify a mobile station. Identification is used to identify valid devices and ban devices that are lost or stolen from the network. The IMEI is 15 of 16 decimal digits long. It consists of three parts. The first 8 digits, the Type Approval Code, are used to identify the model. The next 5 digits are a unique serial number for this type of device. This is followed by either a 1 digit control code or a 2 digit software version number ARFCN - The Absolute Radio Frequency Channel Number (ARFCN) is a unique number given to each radio channel in GSM. The ARFCN can be used to calculate the exact nominal of radio channel frequency. BCCH - The Broadcast Control Channel is a logical broadcast channel used by the base station in a GSM network to send information about the identity of the network. This information is used by a mobile station to get access to the network. This information includes the Mobile Network Code (MNC), the Location Area Code (LAC) and a list of frequencies used by the neighboring cells (BA: BCCH Allocation List) 3 P a g e

4 2. Overview MicroNet GSM IMSI/IMEI catcher is a device used to detect mobile phones active in specific area as well as to precisely detect their location. This unit has been designed primarily for law enforcement and police forces increasing the effectiveness of target cell phones tracking and localization. Other applications of this equipment may include detection of active cellular handsets at border check points, airport luggage check-in areas, conference rooms, etc. MicroNet acts as a base station and logs IMSI and IMEI identities of all the mobile stations in the selected area. It is also possible to remotely detect mobile phone type and manufacturer. MicroNet catcher operation is based on real cellular base station (with true MMC/MNC) emulation at frequency channel selected from the list of neighboring cells in any specific area under different Local Area Code (LAC). All mobile phones within catcher coverage attempt to log into this emulated network, as the signal strength of emulating base station exceeds power levels provided by real base stations. During the registration process of new mobile devices, the catcher grabs relevant information on terminals IMEI and IMSI, as well as information on downlink signal strength at the mobile device antenna. Collected information on IMSI allows detecting which cellular operator SIM card is used. In future, this information can be used to force mobile terminal activation and enable its tracking. IMEI parameters are also used to determine mobile terminals model. In case any mobile device subject for further tracking is logged into MicroNet catcher, operator can add its IMSI (IMEI) into separate list (or folder) and use this information during target mobiles search and localization. Mobile terminal localization is being done with the use of service channel information sent by the mobile as a response to paging requests from MicroNet catcher. Mobile devices location detection is performed using directional antenna and visual real-time information on received signal strength (at mobile terminal) displayed to MicroNet catcher operator. Other mobile terminals (including those held by MicroNet operator) are not included into the active list and receive registration failed message from MicroNet catcher. Consequently, these terminals get registered with their own home networks according to standard authentication procedure. 4 P a g e

5 3. Main features Built-in RF environment monitor to assess and monitor the number of GSM networks in an area, respective Base Stations and neighboring cells lists Automatic configuration the MicroNet base stations modules for optimal effectiveness Full identification of IMSI, IMEI and TMSI information and dynamic control capabilities, including intellectual service denial Optional In Network Calling allowing calls within the MicroNet system Compatibility with any available Direction-Finding system Stable RF performance in high multi-path environments Each transceiver is independently configurable for all Network parameters Uses BCCH manipulation to give a virtual power effect of up to several hundred Watts Full support for GPS logging Downloadable Java Client for use with alternate PC Downloadable PDA Client for use with Windows Mobile Comprehensive database featuring handsets cross-referenced against IMEIs, and networks against PLMNs Built-in Wireless Access point supporting full remote control Uplink port for connection to a WAN facilitating remote diagnostics and simple software upgrading. 5 P a g e

6 4. Applications and modes of operation The MNG-300 catcher supports the following applications: Provides for all mobile terminals registration with MicroNet catcher network within certain selected area (case A) or only those entered in the Target list (case B); Detection of mobile terminals IMSI and IMEI identities within catcher coverage area; Comparison of collected identities with IMSI/IMEI data contained in the Target-list; Support for Target-list mobile terminal search by activating "Measuring report"; Support of communication session with the mobile terminal contained in the Target-list using SMS or voice connection. The following options are available for the user: Display of "XYZ" provider logo on the mobile terminal, and indication of a sustainable received signal strength; Transmission of Measuring report" data is done invisibly to the mobile terminal user; Communication session with the selected mobile terminal can be carried out on behalf of any MSISDN number, which will be displayed on the target phone screen; Indication on target phone attempts to establish outgoing call; Seamless release of the captured mobile terminal back into his home network. Modes of operation Interrogation Mode: in this mode of operation user can collect information on mobile subscribers within the MicroNet catcher unit coverage. Target Mode: this mode supports tracking of any particular mobile terminal. Firewall Mode: in this mode the mobile terminal is captured and forcedly stays registered with the MicroNet catcher. "Feels Like" mode: allows the user to present a feels like TX power to mobile subscriber to log the cellphone into the MicroNet system whilst the MicroNet unit is running on a much lower actual power. 6 P a g e

7 5. List of components 1. GSM transceiver module 2. Control terminal unit (portable computer) with user software 3. Additional 15 Wt power amplifiers and external roof top scanning antenna (optional) 4. BTS direction finder, dual band (1 unit) 5. Cables and connectors set 6. Antenna 900 MHz, 360, 3 dbi 1 pcs 7. Antenna 1800 MHz, 360, 5 dbi 1 pcs 8. Antenna 900/1800, 90, 7 dbi 2 pcs 9. Test mobile phone with Net monitor function 10. Leather enclosure (17 notebook briefcase) 11. Inverter DC/AC 12/220 V, 500 W 12. User manual 7 P a g e

8 6. Specifications Operational specifications Number of monitored mobiles Minimum 255 Power supply Vehicle battery, 11-30V DC, or mains via AC adaptor RF Power Contains two fully functional commercial grade 15W BTS transceivers Handsets acquisition speed up to 800 per minute across two networks Processing Capability 1x BCCH, 1x CBCH (CBAI.50), 19x SDCCH, 6x TCH (EFR/FR) Effective range (City with dense apartments blocks) With the Vehicle mounted directional antenna m, without the Vehicle mounted directional antenna m. Effective range (Rural area) With the Vehicle mounted directional antenna m, without the Vehicle mounted directional antenna m Effective range (Flat terrain with direct LoS) With the Vehicle mounted directional antenna m, without the Vehicle mounted directional antenna m Technical specifications GSM specification version 3GSM Release 1999 Radio Bearers signalling BCCH, AGCH, RACH, CBCH, SACCH, SDCCH, T/FACCH Traffic TCH/FACCH Transmit Power 100mW to 15W in 2dB steps Transmit Power Stability better than +/-2dB across the entire band Frequency Range, E-GSM MHz 914.8MHz for Rx 925.2MHz 959.8MHz for Tx Frequency Range, GSM MHz MHz for Rx MHz MHz for Tx Dynamic range for mobile devices dbm Uplink path sensitivity, E-GSM 900 better than -106 dbm Uplink path sensitivity, GSM 1800 better than -109 dbm Power transmission between 100mW and maximum power, in 2dB steps Receiver Technology DSP based with full per-slot channel equalization (ETSI GSM05.05) Power consumption Less than 20 W (without control terminal unit) Dimensions 525mm x 436mm x 217mm (20.7 x 17 x 8.5 in) Weight 20kg (44 lbs) 8 P a g e

9 7. Omni directional antennas Model: MCA-01 Vertical Polarization, MHz 360 2,5 dbi Input N female Frequency range MHz VSWR <1.5 Gain 2,5 dbi Impedance 50 Q Intermodulation IM3 < -150 dbc (2 x 43 dbm carrier) Polarization Vertical Max. power 50 W (at 50 C ambient temperature) Weight 800 g Radome diameter 20 mm Height 280 mm Material of the radome PHV Color black Mounting on the top of car Diameter magnetic base 80 mm Vertical Pattern 9 P a g e

10 Model: MCA-02 Vertical Polarization, MHz 360 2dBi Input N female Frequency range MHz VSWR <1.5 Gain 2,5 dbi Impedance 50 Q Intermodulation IM3 < -150 dbc (2 x 43 dbm carrier) Polarization Vertical Max. power 50 W (at 50 C ambient temperature) Weight 800 g Radome diameter 20 mm Height 180 mm Material of the radome PHV Color black Mounting on the top of car Diameter magnetic base 80 mm 10 P a g e

11 8. Power inverter True sine wave output (THD<3%) High surge power up to 900W Power ON-OFF switch Front panel indicator for operation status Built-in fan ON-OFF control function LED indication status Rated power/max output power AC voltage 600W/900W Factory setting at 230V Output Frequency 50Hz Waveform True sine wave (THD<3%) at rated in put voltage AC regulation ±3% Saving mode Fron panel indicator Battery voltage Load 5 will be changed to standby mode Battery voltage indication, LED indication 12V Input Voltage range VDC DC current 70A Efficiency 89% Battery Fuse 40A Input Low battery alarm 11.3±4% Protection Low battery shutdown 10.5±4% Battery polarity By internal fuse open Protection Overload 115%-150% load for 10 sec. Operating temperature 0⁰C _ 100% load/0⁰c 60% load Environment Humidity 20% - 90% RN non-condensing Storage Vibration (-30⁰C)(+75⁰C)/ 95%RH (10-50Hz),(3G 10min./1cycle,60min.each along X,Y,Z axes Other Dimensions 350x280x100 Weight 4,3Kg 11 P a g e

12 9. Notes Information accuracy We have made all efforts to ensure the accuracy of the features and techniques presented in this product overview. Restricted Rights You may not reproduce, transmit, transcribe, store in a retrieval system, or translate into any language or computer language, in any form or by any means, electronic, mechanical, optical, magnetic, photographic, manual, or otherwise, any part of this publication without the express permission of Proximus LLC. Limitations This document has the following conditions and restrictions: This document contains proprietary information belonging to Proximus LLC. Such information is supplied solely for assisting explicitly and properly authorized users. No part of its contents may be used for any other purpose, disclosed to any person or firm or reproduced by any means, electronic and mechanical, without the express prior written permission of Proximus LLC. No part or parts of this document shall be copied, used for commercial purposes or passed to any third party for any use, without approval of Proximus LLC. The text and graphics are for the purpose of illustration and reference only. The specifications on which they are based are subject to change without notice. About us Proximus LLC has over 7 years experience developing advanced technology and transforming it into reliable and cost effective products for national security and intelligence agencies including Communications Intelligence (COMINT), Electronics Intelligence (ELINT) and Signals Intelligence (SIGINT). Our technical core competences are in specialized software, wireless technologies, networks protocols and microwave techniques. Company s intelligence solutions are based on the latest technologies and to date have been successfully utilized in more than a dozen countries worldwide. 12 P a g e