GSM COMMUNICATIONS JAMMING - AN INTELLIGENT METHOD

Size: px

Start display at page:

Download "GSM COMMUNICATIONS JAMMING - AN INTELLIGENT METHOD"

Hope Cunningham
6 years ago
Views:

1 BulTrans Proceedings Sepember 2014 Sozopol GSM COMMUNICATIONS JAMMING - AN INTELLIGENT METHOD VESELIN RADKOV Deparmen of Aeronauics, Techmical Universiy, Sofia, Bulgaria vradkov@aero.u-sofia.bg Absrac: The GSM communicaions amming is used in many cases in he reason of naional securiy measures and for governmen and poliical leader s personal securiy and for prevenion of erroris aacks by disance managed bombs. As usual he special radio-ransmiers (Radio-Jammers) are used and hese ones as general used brual RF power force amming by covering he all GSM specrum by amming signal (barrage amming). This one mehod requires high-ransmied power on wide RF diapason and in his reason he proeced area is less han 100m in general. A new amming mehod is offered, based on changes of hin GSM signal srucure in his paper. This one mehod allows more energy effecive Jammers o build and wider areas o be covered. Keywords: ammer, inelligen, mehod, amming, GSM, BCCH. I. Inroducion Improvised explosive devices (IED) have been used as long as explosive weapons have exised. The principle of using explosives in a manner oher han hey were originally developed for has been used for saboage, errorism, insurgency and ad hoc miliary uses is boh well esablished and simple o undersand. The Radio Conrolled IED (RCIED) are using an RF module o iniiae a device. RCIEDs have advanage of flexibiliy; here is no physical link beween commander (erroris people) and device. In he reason GSM neworks are worldwide presened, in many cases as a RF conrolled devise is used a simple mobile elephone. I. Radio amming Communicaion amming devices were firs developed and used by miliary. Jamming is performed by ransmiing a signal o he receiver a he same frequency band or sub-band as he communicaions ransmier ransmis. Jamming is successful when he amming signal denies he usabiliy of he IED (receiver). The ransmier used o rigger he RCIED mus also be wihin range of he receiver. This will depend on a number of facors, as explained below. The key radio-parameers are: Frequency of operaion; Transmied power; Transmi and receive anenna heighs; Anenna gain/loss; Noice floor a he receiver; Sensiiviy of receiver device. Because of he opology of he scenario, i is likely ha he ransmier and device receiver will be wihin a few hundred meers of each oher. The excepion o his can be where exising neworks are used, such as GSM mobile phone sysems. In his case, he BTS used o relay he rigger command may be many kilomeers away. I is possible o idenify he criical facors ha will affec performance of he RCIED s communicaion link Terrain effecs will no normally vary significanly wihin he operaional range, alhough of course here are excepions o his; Amospheric variaions will in general be negligible; Local cluer such as buildings or dense vegeaion may be dominan aenuaion facor;

Ground conduciviy may be an imporan facor wihin his regime, since he anennas will ypically be so low above local ground (as general he RCIED s anenna will be on he ground or even under-ground); Local

2 Ground conduciviy may be an imporan facor wihin his regime, since he anennas will ypically be so low above local ground (as general he RCIED s anenna will be on he ground or even under-ground); Local fading will be an imporan facor wihin he nominal coverage range. In erms of radio predicion and simulaion i is usually no possible o deermine where precisely an aack may occur and herefore from a device suppression (i. e. amming) poin of view, a siegeneral model approach is necessary. US forces adoped a simple model wih a correcion for ground conduciviy [1]. This is used o represen boh arge and ammer links. This one model assumes ha he ammer is for VHF communicaions links only, ha he effecive Jammer o Signal Raio (JSR) is approximaely 8:1 (linear erms) and ha he links have no or minimal inervening errain [1]. The model provides wo formulae, he firs one o deermine he necessary amming power: H D P And he second, which deermines he maximum effecive range of a ammer: z = PK. H. (1) D n P D = D., (2) 2 P PK H where: P minimum amming power required; P effecive power oupu by he enemy ransmier; H - elevaion of ammer above sea level; H elevaion of enemy ransmier above sea level; D ammer-o receiver link disance, km; D enemy ransmier-o-receiver link disance, km. K ammer uning accuracy: =2 for FM receivers in VHF range; n errain and ground conduciviy facor: =5 very rough errain; poor conduciviy. =4 moderaely rough errain; fair o good conduciviy; =3 rolling hills; good conduciviy; =2 level errain; good conduciviy. The performance of he power predicion model is illusraed in Figure 1 for differen caegories of ground conduciviy [1]. The figure shows he power required o am a ransmission link (enemy) of given disances. The (enemy) communicaion link disance is shown on he boom axis. The amming link disance is a consan 10 km. Noice ha (1) and (2) are independen of frequency and also of minimum receive sensiiviy of he enemy receiver. Also noice ha for shor ranges, n he amming power is very high and probably unreliasable. This is no unreasonable because if he enemy communicaion devices are closer ogeher, he link is far more difficul o am. Fig.1 US amming model for differen ground condiions. I mus be noed ha here are several caveas o he use of his model [1]: Firsly, i assumes no significan obsrucions beween ransmier and receiver; Cluer is no accouned for his model; The value produced is a nominal figure o which fading characerisics mus be applied; The model is fairly coarse. The model is coarse because of describing and analyzing a unique se of circumsances using acual errain and cluer values will resul in a sie-specific model ha can be generalized o differen scenarios. If he ammer does no have he oupu power o am a wide band coninuously, i can increase is insananeous amming level by pulsed amming. In pulsed amming, he ammer sweeps he wide band amming each narrow sub-band for a shor period of ime. Usually a successful aack requires ha he ammer s power is roughly equal o signal s power a he receiver s place. Classic amming ransmission is simply bandlimied noise (barrage amming, denial amming, ec.). The obecive is o inec an inerference signal ino he communicaions frequency so ha he acual signal is compleely submerged by inerference. In general he GSM ammer is a device ha ransmi signal on he same frequency a which he GSM sysem operaes, he amming success when he mobile phones in he area where he ammer is locaed are disabled. The non-inelligen ammer is used o form a resriced (proeced) area (illusraed in Figure 2) [2], and i is designed o block all mobile phones operae in a cerain frequency bands. Fig.2 Proeced area formed by GSM ammer.

3 As usual, he non-inelligen sysem ams he whole downlink frequency band (barrage amming) even hough he mobile phone uses only a small porion of he band. Following (2), i is easy o noe he disance has a srong influence on he signal loss. If he D is doubled, he ammer has o quadruple is oupu in order for he amming o have he same effec. So, he non-inelligen barrage signal ammers have high energy consumpion and low effeciveness, and capable o form as usual abou m 2 proeced area. II. Inelligen GSM amming II.1. GSM Air Inerface. If an acive connecion exis beween he MS and BTS he mobile erminal is said o be in dedicaed mode. If he MS is swiched on bu remains passive o he nework he erminal is said o be in idle mode. In he GSM nework, he Base Transceiver Saion (BTS) is he acual RF ransceiver using U m air inerface. In U m inerface he physical channels consis of all he available ime-slos (TS) of a BTS, i. e. each TS forms one physical channel. The oal number of TS is 8 (from #0 o #7). On he oher hand he GSM channels consis a se of logical channels which each perform a special ask. There are welve differen ypes of logical channels in GSM (Table 1), separaed ino 3 groups: Table 1 Channel name Logical Channel name Direcion BCH (Broadcas Conrol Channels) CCCH (Common Conrol Channels) Dedicaed Conrol Channels TCH (Traffic Channels) FCCH (Frequency Correcion BTS MS SCH (Synchronizaion BTS MS BCCH (Broadcas Conrol BTS MS PCH (Paging Conrol BTS MS RACH (Random Access BTS MS AGCH (Access Gran BTS MS CBCH (Cell Broadcas BTS MS SDCCH (Sand-Alone Dedicaed Conrol SACCH (Slow Associaed Conrol FACCH (Fas Associaion Conrol TCH (Traffic channel for voice/daa) In he GSM echnology sandard each TS exiss eiher 51 imes in a muli-frame 51 or 26 imes in a muli-frame 26. There are los of differen ways of mapping logical channels on a physical one. The physical TS#0 is reserved for he common channels and herefore his one is he mos imporan. The raffic channels are used for voice and daa load ransporaion so hese ones are never mapped on TS#0 of he beacon (BCCH) frequency. The following logical channels are used in idle mode: FCCH - in search of a new beacon frequency; SCH - in search of a new beacon frequency; BCCH - while monioring he sysem (GSM nework) informaion; PCH - while monioring wheher here is call; AGCH - waiing for he immediae assignmen of a channel; RACH - sending a channel reques o he GSM nework. Asses o hese channels is possible following he burs sequence shown in Figure 3. Fig. 3. A burs sequence a he Beacon frequency TS#0. Mos channels ransmi heir daa on a normal burs. In TS#0 a firs a Frequency correcion burs is emied, followed by Synchronizaion burss. The following 4 burss se up a message from he BCCH. The nex 4 burss se up a message from he paging channel, and so on. II.2. Air inerface Logical channels II.2.1. Frequency Correcion Channel The FCCH is only required for he operaion of he radio subsysem and is only ask is o carry informaion for frequency correcion of he MS. I has no supplemenary informaion abou he BTS or he nework. The FCCH hence provides only informaion abou he exisence of a cell using he concerned frequency which enables he MS o measure he signal srengh. The so called Frequency Burs is direcly mapped on he TS#0, here is no coding or he like, since here is no biinformaion o be broadcased. II.2.2. Synchronizaion Channel The SCH aims o help he mobile o synchronize o a BTS. I provides a long raining sequence for synchronizaion and he Frame Synchronizaion Elemen. The Synchronizaion Informaion Elemen consiss hence of 25 Bis. These Bis are correcion

4 coded and resuling in a 77 bi message which is spli up ino wo 39-bi secions emied in a synchronizaion burs. II.2.3. Broadcas Conrol Channel When a mobile erminal is swiched on, i changes from saus MS - power off o he iniial saus MS- power on (idle), MS sars a "cell selecion procedure", as usual his is a BCCH. There is a beacon frequency on his channel, i. e. a disinguishing frequency in a cell. In idle mode he mobile lisens o he BCCH, which is inended o broadcas regularly all necessary informaion o he MS which i needs o regiser in he sysem. The nework will provide he following informaion: idenificaion of he nework, locaion area and cell; informaion for candidae cell measuremen; descripion of he conrol channel srucure; uilizaion of he RACH; differen suppored opions; lengh of he message par belonging o phase1 proocol; BCCH scheduling (opional). This daa will be delivered in Sysem Informaion Messages. Every Sysem Informaion Message is wrapped ino a 23-bye-word. Afer hese 23 byes are (correcion) coded and inerleaved. The word, now exended o 456 bis plus 4*2 flag bis, is sen on he four burss of every muli-frame reserved for he BCCH. This means here is one Sysem Informaion Message ransmied every 235,38ms. II.2.4. Paging Channel If a mobile is called, his call will be announced o he nework by sending a paging message (Paging Reques) on paging channel of he CCCH. The mobile will subsequenly send a Channel Reques on he RACH indicaing in he esablishmen cause field of his message ha i has received a paging message. This causes he nework o allocae a dedicaed channel for his MS, which will hen send a paging response on he DCCH o he nework. Afer he usual auhenicaion process any daa ransmied on his channel will be ciphered. In a sequence sep he acual call esablishmen will be iniiaed by he nework. II.2.5. Random Access Channel RACH message has 4 oces lengh as his is shown in Figure 4 and his one message conains informaion abou access permission o he nework. The RACH Conrol Parameers locaed consis he cell barring access indicaor (bi 2 in oce 2). If his one bi is 0, he cell is no blocked, if bi sae is 1, he cell is blocked for access and in his case MS will be informed he cell is no in service nor for incoming nor for originaed call. In oher words, he all MS served by his channel (i. e. by his BTS) will be ou of funcionaliy, neverheless hey are urned on. Fig. 4. RACH conrol parameers Parameer s meaning: Max Rerains: maximum number of access aemps; Tx-ineger: number of ime slos o spread access aemps; Cell Barr Access: barring opions indicaor RE: call re-esablishmen EC: emergency call AC Cn: access conrol classes (from 0, 1, 2, 3. o 15)

5 III. Mehod for inelligen GSM amming Following he Logical channels srucure used in GSM neworks, an inelligen GSM amming is possible o be implemened by changing he sysem informaion messages sen on he BCCH. The idea is o change he RACH message and especially CELL-BARR-ACCESS bi from 0 o 1. The BCCH has o be emied in he modified version consanly and wih a significanly bigger signal srengh han he BCCH version emied by he BTS. In general his is no serious problem in he reason he disance beween he ammer and RCIED will be many imes shored han he disance beween BTS and RCIED. The realizaion of his mehod will include following ammer s funcions: receiving of he BCCH of BTS wih he bigges signal srengh; exracion and decoding of he received BCCH; he abiliy o exrac and o modify all BCCH messages; he abiliy o re-emi he modified and re-coded BCCH. In his mehod he GSM ammer acs as a "reranslaor" beween he BTS and all MS locaed in he proeced zone. This means i eiher acs as he BTS wih he bigges signal srengh in he proeced zone, aking over is "personaliy" i. e. making he MS believe i is he real BTS iself. The ammer mus o have wo separae anennas: one for signal recepion and one for he emission of he modified signal. This is for wo reasons. Firsly, he cell phone ammer has o lisen o he downlink signal from BTS and o re-emi his one signal afer signal processing (i. e. modified signal) a he same ime. Secondly, he emiing anenna has o be separaed from he receiving one since i oherwise would perurb is receiving signals. The funcionaliy of he BCCH-mehod will hence be as follows: 1.I firsly scans he frequency specrum, looking for he sronges BTS and hen synchronizes o his BTS. In he reason he ammer and RCIED will be close each oher, he sronges BCCH emission o he ammer will also be he sronges one o any MS in he proeced zone. 2.Once synchronized o he BTS he ammer will ake one 51-mulirame, exrac he BCCH and change he Sysem Informaion Messages (i. e. RACH conrol parameers) o he desired amming values. There is one Sysem Informaion Message emied every 0,235s (every muli-frame). 3.Change of he original RACH message by he fake message. The BCCH messages ha do no conain he RACH will be simply forwarded. 4.Finally, boh false/original BCCH will be emied on air by Transmier working on separae anenna. The aim is o omi a sronger signal han he served GSM cell (BTS). Conclusions 1.The presened above mehod for GSM communicaions amming is independen from any special device or nework feaure and will hence work on any GSM cell phone in any GSM nework. I will also be applicable o fuure devices. 2.The presened mehod is very useful o build an inelligen ammer device. In fac his one device will be no a ypical ammer, bu neverheless he final resul will be GSM services soppage on he wide proeced area. 3. I is no necessary high oupu amming power in he reason of: - he inelligen ammer will be very close o he RCIED han served BTS; - he inelligen ammer will emis power on BCCH frequency only, no on wide GSM diapazon. 4.The disadvanages of his mehod are: - he BCCH has o be modified and reemied all he ime. This disadvanage hence has o be compensaed by a good operaion saus conrol sraegy. - if here proeced area is covered by a few GSM operaors, i is mus o have ammer for each operaor coverage. Acnowledgemens The auhor hanks o Sinis Technology Company and o NIIS a he Technical Universiy of Sofia for financial suppor under Conrac N References [1] Adrian Graham, Communicaions, Radar and Elecronic Warfare, John Wiley & Sons Ld., 2011 [2] Corporae broshure, Sinis Technology Ld., Sofia, [3] ETSI: Digial cellular elecommunicaions sysem; Call Barring supplemenary services - Sage 2 (GSM 03.88), version 5.0, [4] ETSI: European digial cellular elecommunicaions sysem (Phase 2); Operaor deermined barring (GSM 02.41), 1994.

Examination Mobile & Wireless Networking ( ) April 12,

Examination Mobile & Wireless Networking ( ) April 12, Page 1 of 5 Examinaion Mobile & Wireless Neworking (192620010) April 12, 2017 13.45 16.45 Noes: Only he overhead shees used in he course, 2 double-sided shees of noes (any fon size/densiy!), and a dicionary