INTELLIGENCE MOBILE LOCATOR. World Leader in Supplying INTELLIGENCE Equipment and Training TA08002

Transcription

1 MOBILE LOCATOR TA08002 Coverage of Uall fouru frequency bands (850, 900, 1800, 1900) 4 wide-band receivers and 64 digital processing receivers Real-time handling of A5/1 and A5/2 encryption types Monitoring & mass recording of all traffic from U8-16 BTS cells Concurrent processing capacity of U256 duplexu voice channels Concurrent Ulive monitoringu of 40 duplex voice calls Built-in hard-disk (SSD) storage of 2 TB. Post processing utility with Ufull mission playbacku & data-mining Smart search engine utilizing SMS keywords, partial digits, etc. Automatic Mobile-phone ULocalizationU (AML) Very compact and low weight equipment (43x33x9cm, 8Kg

2 SYSTEM MAIN COMPONENTS Wide-Band RF Module (WRM) Wide-Band RF (WBR) module comprised of 2 x Antenna inputs (one for down-link and one for uplink signals), RF amplification and distribution, 4 x wide-band receivers and digital signal multiplexers. The digital outputs are routed to a bank of 64 (32 duplex) channelized digital receivers, implemented on Figure 3: Wide-Band RF Modul (WRM) Digital Receiver Module (DRM) Digital Receiver Module (DRM) includes 8 channelized digital receivers Each of the receivers is directly controlled by the Management Server which tunes the receiver into the necessary frequency for Uprocessing of all channels (time-slots) included within each frequency. The board is fed with wide-band input signal which is split between the receivers. Each receiver can follow all the traffic (data + voice) from any specific base-station transceiver (TRX), no matter how many frequencies are being used (in Frequency-Hopping mode) by this BTS. So 1 x DRM module can fully intercept 4 duplex TRXs. All the traffic from the DRM is processed by the Signal Processing Board (SPB). A typical PGMU-64WX configuration includes 8 x DRM boards (64 digital receivers), so it can fully coverall the traffic from 32 duplex TRXs. A typical BTS has 2-4 TRXs, so PGMU-64WX can fully cover all the traffic emanating from 16 BTSs.

3 SIGNAL PROCESSING BOARD The Signal Processing Board (SPB) has 2 essential responsibilities: The SPB is fed by data from the DRM and it demodulates the signals from off-the-air raw data into GSM standard known commands. Chains of FPGA and DSP processors embedded in the board enable this complicated operation. The decoded data is sent to the Management Server using LAN connection. The SPB is also responsible for managing and controlling the DRMs. There is 1 SPB in a PGMU-64WX system configuration. DECIPHER ACCELERATED PROCESSING BOARD (APB) The PGMU includes an integrated, built-in, Uvery high-speed decipheru, comprised of ASIC based Accelerated Processing Boards (APB), enabling an average of 0.25 seconds deciphering time for A5/1. UThe APB is connected via Ethernet LAN, through a switch, to the decipher software in the Management Server (Laptop). W MANAGEMENT SERVER (MS) The Management Server (MS) is located in the laptop. MS is in charge of multiple tasks and communicates directly (or in-direct) with all of the components mentioned previously: The GUI (Graphic User Interface) is a sub-server in MS. The interceptor which controls and manages the receivers is a sub-server in MS. SQL database sub-server is stored on the laptop. A5/1 and A5/2 decipher management (Queues, priorities, etc.) There are no special storing performance requirements demanded from the laptop. 16GB RAM of memory and approximately 2TB of HD (SSD) storage are enough for 3-days intensive operation. The system works under Windows 7 Operating System.B OPERATION CONCEPT The system is set to process random sessions and at the same time to match the retrieved information with pre-defined parameters configured by the system operator. These parameters are able to assist interception of specific known targets such as: TMSI, IMSI, IMEI, MSISDN, TMSI and IMSI. Mostly, only one of these parameters is used by networks as the real mobile phone number is never transmitted over the air in GSM networks. Using a special technique, the system discovers the identity that corresponds to the particular phone number. Since TMSI is temporary and the network changes it from time to time, the system automatically follows all TMSI modifications and automatically updates them in the Target List without intervention of the system operator. Pre-defined configuration is able to assist us intercepting unknown targets as well by filtering specific SMS keywords, roaming subscribers or phone numbers. Obviously, target or potential target interception will be prioritized over random interception. Additionally, within the target list, targets are prioritized and the system follows the operator s default in case of several targets at the same time. However, UnoneU of the intercepted session is gone, random, potential target or target. At the same time of live monitoring, the system records the entire intercepted data. The operator can, at any time, stop the live monitoring and analyze (playback) off-line the gathered recordings session by session, filtered or entirely.

4 GUI MAIN SCREEN The first display when starting the GUI application is found in the figure below. The screen is divided for 3 main windows: UOperation WindowU - This window details the information gathered from the network and includes the BTS Scanned list, total sessions detected and ongoing monitored sessions. UAssignment WindowU - This window is in charge of data management and includes target and potential target lists and filters set and BTS allocation. Intercepted SMS sessions are stored on a separate tab in this window. UEvent Log windowu - This window displays the communication commands and alerts between the different servers, components and the monitored networks. STEP BY STEP OPERATION BASICS 8BBTS Scan The system is now all connected and waiting for operation. Our first step is scanning the environment for BTS. The receivers are commanded and Scan BTS list is created.

5 1. Provider s name. 2. Mobile Country Code. 3. Mobile Network Code. 4. Location Area Code. 5. Base Station unique ID. 6. Channel number. 7. Signal level. 8. Signal quality. 9. List of frequencies used for hopping. 10. Antenna number. 11. Date. 12. Selection checkbox. BTS ALLOCATION Once scanning is completed, BTS must be allocated for operation according to intelligence demands and environment conditions. Chosen BTS are referred to the BTS List. 1. Frequency band used. 2. Number of receivers allocated. 3. List of BTS used for handover with the specific BTS. 4. BTS priority used for efficient resource allocation. 5. Duplex enable/disable UPLINK signals. 6. Select enable/disable the BTS for monitoring. SILENT CALL/SMS The targeted area of operation is now mapped. Our next step should be intercepting the target phone. For that, the target s TMSI must be defined in the target list. Since the only available parameter is the target s phone number, the Silent Call/SMS tool finds the correlation between the phone number and the its TMSI.

6 Live Monitoring / Recording Now we know both the network environment and the target s identity. The next step is to begin the process of monitoring. Target, Random or Reverse. The Session Activities window displays the intercepted SMS/calls sessions. These sessions can be processed during Ulive monitoringu or by Uoffline playbacku. The entire sessions listed in the Session Activities window are recorded. Colored sessions alert for operator s interest. (Blue = random, Red = target, Yellow = potential target, Green = associated to target) Sessions are processed according to LIFO (Last In First Out). Sessions with interest are prioritized over random sessions during live monitoring. 1. Session number. 2. Transmission s direction. (Incoming / Outgoing) 3. TMSI of the monitored subscriber. 4. IMSI of the monitored subscriber. 5. IMEI of the monitored subscriber. 6. Number calling the monitored subscriber. 7. Number dialed by the monitored subscriber. 8. Encryption type. 9. Ciphering key of the monitored subscriber. 10. Uplink interception. 11. Distance between the monitored subscriber and the BTS providing service to the subscriber. 12. Date. 13. Comment. (Session type, target identity) 12B Other Displays Target List: List of targets defined by the operator Potential Target List: List of targets defined by sessions intercepted according to POI List POI List: Set of rules for filtering incoming sessions defined by the operator SMS: Window to display intercepted SMS sessions details

7 Automatic Mobile-phone Localization (AML) This feature will estimate the approximate geographical location of an MS during voice conversation, with A typical accuracy (uncertainty circle) of 50 meters, pending the following conditions: Minimum intercepted call length 30 sec (shorter period yield less accuracy) Minimum of 4 intercepted BTS in same cellular network as the target mobile phone. The geographical location of the BTS is known. The location results (as well as the BTSs location) for all targeted mobile phones are displayed on geographical map background. A typical presentation of the localization result is shown below: In addition the system displays a BTS map with all the scanned BTS enabling operational planning to achieve optimal coverage of the operational area. The BTS are displayed in a map or in satellite picture by selection of the operator

8 BYSTEM CHARACTERISTICS RECEPTION BANDS RECEPTION RANGE FOR FORWARD CHANNEL (MHZ) 869 to RECEPTION RANGE FOR REVERSE CHANNEL (MHZ) 824 to FREQUENCY CHANNEL SPACING 200KHz NO OF ANTENNA INPUTS 2 (ONE FOR DL AND ONE FOR UL RECEPTION) RECEIVER TYPE WIDE-BAND DIGITAL RECEIVER NO OF WIDE-BAND RECEIVERS 4 NO OF CHANNELIZED DIGITAL RECEIVERS 64 (32 DUPLEX) SYSTEM SENSITIVITY BER FREQUENCY STABILITY 5X10-9 DYNAMICAL RANGE > 80 db DOWNLINK (BTS) RECEPTION RANGE KM UPLINK (MS) RECEPTION RANGE 500-1,000 meters FULLY INTERCEPTED BTS TRANSCEIVERS (TRX) 32 CONCURRENTLY PROCESSED VOICE CHANNELS 512 (256 duplex) CONCURRENT LIVE MONITORING CALLS 40 Duplex SUPPORTED VOICE CODECS RPE/LTP: FR, EFR, HR, AMR-FR, AMR-HR MONITORED CHANNELS BCCH, CCCH, SACCH, SDCCH, FACCH, TCH AUTOMATIC LOCALIZATION ACCURACY meters A5/2 DECIPHER PROCESSING TIME 0.05 sec A5/1 DECIPHER PROCESSING TIME 0.25 sec DIMENSION 19, 2U (43x33x9cm) WEIGHT 8 Kg POWER SUPPLY 12VDC + 220VAC POWER CONSUMPTION 350W WORKING TEMPERATURE RANGE 0 c +50 c RECEPTION CONDITIONS The PGMU reception distance depends on several parameters, as following: - The distance between the PGMU and the target mobile phone. - The antenna type - The specific terrain/ environment conditions, i.e. urban/ rural area, etc. - The distance between the target phone and the base-station. Generally speaking, the system can easily intercept traffic from BTS to MS (Forward Channel/Downlink) at a distance of 10 to 20 km. The signal from the Mobile Phone to the BTS (Reverse Channel/Uplink) is very low, so the effective reception range from the PGMU to the target hand-phone in order to receive the reverse (uplink) channel using omni-directional antenna is typically 500 meters (in urban line of sight area) or typically 1 km (in rural, line-of-sight area). With compact directional U antenna (8 dbi gain) - the range can be increased to 1 kilometers (in Urban area) or 3 km in rural areas and for stationary high gain antennas (>20 dbi gain) the effective range for the reverse channel may be increased to as much as km in rural line-of-sight area.