1 of 66

OpenBTS Workshop

Surya Institute

October 29th 2012

2 of 66

Me

3 of 66

Me

  • Graduate Student at UC Berkeley
    • Computer Science
    • Technology and Infrastructure for Emerging Regions (TIER)
    • Working for
      • Eric Brewer (CS)
      • Tapan Parikh (iSchool)

4 of 66

Me

  • Graduate Student at UC Berkeley
  • Employee at Range Networks
    • Company built off OpenBTS
    • Developer
    • Community Relations Manager
    • Open-source Manager

5 of 66

Me

  • Graduate Student at UC Berkeley
  • Employee at Range Networks

Everything in this talk is my opinion alone and does not represent anything from Range Networks!

6 of 66

Cellular Telephony

A brief background

7 of 66

8 of 66

9 of 66

10 of 66

11 of 66

12 of 66

OpenBTS

What is it?

13 of 66

OpenBTS

  • Bridges Cellular (GSM) and Internet (VoIP)

14 of 66

Components

  • OpenBTS
    • The actual transceiver/bridge
  • sipauthserve
    • The Home Location Registrar (HLR)
  • smqueue
    • The Short Message Service Center (SMSC)
  • RRLPService
    • The Radio Resource Location Protocol Server
      • Does location services

15 of 66

16 of 66

Demo

17 of 66

Evil Telco (ETS)

18 of 66

ETS

  • System I have built for demonstrating what a mobile network knows about you
    • Primarily for activists in conflict countries
  • Record all calls/sms
  • Filter SMS
  • Detect encrypted SMS
  • Capture IMSI/IMEI/Location

19 of 66

20 of 66

Burning Man

21 of 66

22 of 66

23 of 66

24 of 66

25 of 66

26 of 66

27 of 66

28 of 66

29 of 66

30 of 66

31 of 66

Burning Man

  • 5 Sites
    • 3 Multi-channel
    • 2 Single-channel
  • 1000+ subscribers
    • 1.5 days of "Open Registration"
  • 7500+ calls
    • Mostly outbound

32 of 66

Papua, Indonesia

33 of 66

The Village Base Station

  • My Thesis project
  • BTS Optimized for off-grid rural deployments by small operators
  • Will be deploying in rural papua
    • Right now! That's why I'm here.

34 of 66

The Village Base Station

  • Basic idea, turn the BTS when not in use
  • Use "Wake up radio" to wake the BTS when needed
    • Saves up to 85% of the power
    • Call this "virtual coverage"

35 of 66

Virtual Coverage

36 of 66

Virtual Coverage

37 of 66

Virtual Coverage

38 of 66

Virtual Coverage

39 of 66

Virtual Coverage

40 of 66

Virtual Coverage

41 of 66

Virtual Coverage

42 of 66

Virtual Coverage

43 of 66

Virtual Coverage

44 of 66

45 of 66

46 of 66

47 of 66

48 of 66

49 of 66

50 of 66

51 of 66

52 of 66

53 of 66

54 of 66

55 of 66

Other Projects

56 of 66

Other Projects

  • Thomas Tsou
    • Virginia Tech
    • Developer on OpenBTS
    • Working on MultiARFCN support for Ettus radios
      • And other stuff
  • Fairwaives
    • Chemeris/Surav et al
    • Developing open hardware
      • UmTRX
    • Handover for public release
    • GPRS Support for public release

57 of 66

Other Projects

  • Range Networks
    • Founded by original OpenBTS developers
      • David Burgess/Harvind Samra
    • ~ 10 Employees
    • Provide commercial (non-GPL) release of OpenBTS
    • GPRS Support
    • Handover Support
    • Sell "telcom-grade" equipment

58 of 66

Getting Started

59 of 66

Hardware

  • Open Hardware
    • Ettus Equipment
    • USRP1
      • Requires clock/solder
      • Cost
        • USRP: 700USD
        • 2 RFX900s: 550USD
        • Antennas: 60USD
        • Clocktamers: 300USD
        • Total: ~1600USD
      • Quality:
        • Medium, with right equipment could build reasonable large-scale BTS

60 of 66

Hardware

  • Open Hardware
    • Ettus Equipment
    • USRP1
    • B100
      • Works "out of the box"
        • No clock modifications
      • Cost
        • B100: 650USD
        • RFX1800: 275USD
        • Total: 900USD
          • Ettus sells package of B100+RFX1800 for 770USD
      • Quality
        • Low, good enough for test bed
        • Clock primary limiter
        • Channel separation for 1 daughterboard is another

61 of 66

Hardware

  • Open Hardware
  • Range Networks
    • RAD1
      • Custom designed
      • Cost
        • 5000 USD Alone
        • 15000 USD for 5150 - Commercial BTS solution
      • Quality
        • Very good, designed for major telcos

62 of 66

Software

  • The software radio is connected to a computer, which runs OpenBTS
  • Operating System
    • Any *nix machine
      • Linux/BSD (Mac)/Etc
  • OpenBTS
    • Available here: https://wush.net/trac/rangepublic
    • Contains information on
      • Downloading source code
      • Building code
      • Configuring OpenBTS

63 of 66

Issues

64 of 66

Issues

  • Spectrum License
    • GSM operates in licensed spectrum
    • Major Telcos pay literally billions for these licenses
      • They won't share

65 of 66

Issues

  • Spectrum License
  • Telcom Interconnect
    • Need to interface with existing phone networks
    • VoIP
      • Commonly done with Direct Inward Dialing (DID)
        • Required by law to be provided in US
      • ISDN/Hardware etc
    • SS7/MAP
      • Roaming agreement
      • Access to telco HLR
      • Not yet implemented in OpenBTS

66 of 66

Kurtis Heimerl

Email: kheimerl@cs.berkeley.edu

Twitter: @kheimerl

tier.cs.berkeley.edu

cs.berkeley.edu/~kheimerl