Copyright © 2007, Tim Moors Locating Users of Mobile Phones Tim Moors Senior Lecturer School of...

Copyright © 2007, Tim Moors

Locating Users of Mobile Phones

Tim MoorsSenior Lecturer

School of Electrical Engineering and TelecommunicationsUniversity of New South Wales

Sydney, NSW, Australia

[email protected]

2


Outline

• Generations of mobile phones• Phone identifiers• Cellular location

• Cellular communication• The communication process• Physical cell selection

• Other locators• Summary and Questions

3


Generations of mobile phonesCellular? Digital? Provision for “data” Rate

0

1

2

2.5

3

3.5

4?

No No No No 8kHz

Yes No No No 8kHz

Yes Yes Yes No 9.6kb/s

Yes Yes Yes No 114kb/s

Yes Yes Yes No 384kb/s

Yes Yes Yes No 14.4Mb/s

Yes Yes Yes Yes ?

VOIP = Voice Over Internet Protocol

Support? VOIPYear

1970s

1981

1993

1990s

2000

today

?

GNames

MTS

AMPS

GSM

GPRS

IMT-2000

HSPA

?

http://park.org/Japan/NTT/DM/images/RF004900_s.gifhttp://luciafreitas.tripod.com/umpoucodetudo/EricssonHotLine.jpghttp://www.mobilebulgaria.com/uploads/mobiles/2004/01/pic_3_484.jpghttp://www.three.com.auwww.belkin.com/skype/howitworks/

4


Handset serial number:International Mobile Equipment Identity (IMEI)

• principally for locking phone to a service; theoretically also to block stolen handsets

• press “*# 06 #” to view

SIM card (“dual SIM” in some phones)16kB-512kB memory contains:• address book, personal settings, etc• codes for securing access to phone, network• International Mobile Subscriber Identity (IMSI):

Identifies phone within mobile phone system

“Phone number”Mobile Station Integrated Services Digital Network (identifier) (MSISDN)

translated to IMSI at edge of mobile phone system

We usually want to locate people, not phones.

Phone identifiers

SIM = subscriber identity module

#

5


Outline


• Cellular communication• Mobile vs cellular phones• Why cellular?• Base station snapshots• Cellular issues

• The communication process• Physical cell selection


6


Mobile vs cellular phones

Radio range is limited by:• power (limited by mobility and health), • antennas, • noise/interference level, and • signal processing

Typical potential range: 10s of km in freespace (e.g. pastoral)• Usually don’t use full range due to congestive effects

• Typical suburban effective range: 3km• Temporary base stations installed for large events

e.g. New Years Eve on Sydney Harbour• Real environments aren’t freespace; have “clutter”

e.g. terrain, buildings, vegetation, mobile vehicles/people may find blackspots in buildings only kms from base station

Location of mobile phones is often based on this limited range.

Current phones are cellular, despite being called “mobile” in Aust.

7


Why cellular?

Confining signals: allows a frequency to be concurrently used

elsewhere, raising capacity reduces power needed,

shrink battery/elongate lifetime contains base station faults

Hexagonal cells tessellateand approximate circles(distance = main determinant of quality)

Usually sectorise cells triplets of directional antennas in a triangular arrangement on tower

8


Base station snapshots

9


Cellular issues

• Cell density should reflect subscriber density Better localisation in denser (e.g. urban) areas

Subscribers need to determine power level to use:1. Mobiles measures strength and error rate2. Mobile notifies Base Station3. Base Station indicates what power level to use

• Base Station position subject to available real estate• Signals don’t propagate in free space

Real cells aren’t neat hexagons Complex to determine which tower covers a particular point

• Phone system needs to• locate mobile user in order to establish call to it• “handover” mobile users between towers.

Handover also used to shift load during congestionBut logs generally record first cell, before any handover

10


Outline


• Cellular communication• The communication process

• Frequencies• Signalling channels• Ephemeral location for call setup• What gets logged?

• Physical cell selection• Other locators• Summary and Questions

11


Frequencies

Bands of frequencies are divided into channels, assigned to different telcos, divided amongst calls.

Bands:• Main GSM bands: (others: 850MHz, 1900MHz)

• 900MHz (890-915, 935-960MHz)• 1800MHz (1710-1785, 1805-1880)

• Main 3G band: 2100MHz (Telstra on 850MHz)Time-division of channel 8 calls

Effect on location:• # antennas: Separate antennas for each band

more antennas more directivity• Logged band: 900MHz propagates better than 1800MHz

usually establish calls on 900MHz, then hand over to 1800MHz if quality OK most calls logged as established on a 900MHz cell

125 channels375 channels

12


Signalling channels• Broadcast: Base Station announces identity and frequency

parameters• Common Control Channels

• Paging: for Base Station to notify phone of a call• Random access: for phone to request access; response comes on an...• “Access grant” channel: Indicates which Dedicated Control Channel to

use• Dedicated Control Channel: Dedicated to a specific call (e.g. to

control handset power)

Basic call processes:1. Phone monitors Broadcast ch. to identify local Base Stations2. Phone chooses Base Station, by strongest signal3. Phone requests access using Random Access Channel

If (unlikely) can’t access best Base Station (due to interference or congestion on Random Access Channel); then try 2nd best

4. Base station indicates channels (DCCH and voice) to use(Receiving call: Paging rather than request access + Access grant)

13


Ephemeral location for call setupNeed to track location of phone in order to call it“location areas” are non-overlapping groups of cells; larger areas: Reduce frequency of location updates = mobile transmissions Increase area covered when paging = mobile receipts and traffic

Location Registers:• Phone number home MSC Home LR

• tracks subscriber’s location• records ‘service profile’ (e.g. caller ID, SMS, etc)

• Each location area has a Visitor LR

Location update process:1. Mobile identifies new cell (through Broadcast)2. Mobile reports to new Visitor LR for that cell3. New Visitor LR notifies Home LR of location4. HLR replies to new VLR with user’s ‘service profile’

then tells old VLR to delete recordCalls to mobile go through HLR to current location;

page to determine cell within the location area

Location is updated whenever phone is on(not just during call setup)

Information is ephemeral

14


What gets logged?

Logs are kept for• both pre-paid and plan-based phones• voice (“regular”) calls and messages

Available (to telco) in various forms:• “cell dump”: All calls through a certain Base Station or cell• “Call Charge Record”: for a particular phone (IMEI or MSISDN)

What gets logged:• Date & time (when call was established), duration• Phone numbers (MSISDN) of both parties• Record Type: Numeric code indicating:

• Voice or message• Which party initiated the call

• IMEI of the mobile handset (served by this telco)• Cell IDs

• First Cell ID: Where the call was established[Cells traversed during call are not logged]

• Last Cell ID: Where the call was released (A recent addition to logs.)

15


Outline



• Sample antenna• Choosing which cell of a tower• Choosing which tower


16


Sample antenna

Argus Antennas JPX310D

JPX310D AzimuthElevation

Pictures from http://www.argusantennas.com/main/?c=custom/argus&custom/argus_task=view_product&product_code=JPX310D&mode=generic

17


Choosing which cell of a tower

Environmental factors equally affect allantennas on a tower since they are effectively co-located

(c.f. choosing which tower)

Choice of cell affected only by:• Radiation patterns

typically symmetrical• Resolution with which phone

can distinguish signal strengths• Uncertain: No worse than bar display,

but unsure of requisite and signalling accuracy• Grey area of +/- 10 degrees around demarcation line

18


Choosing which tower

Signal strength diminishes with distance,as energy is dissipated and absorbed

Signals can be absorbed by obstructions (terrain, buildings, people) reflected, particularly by metal (rooves, vehicles)

• generally weaker than direct signal, butmay be all that is available in a dense environment.

received through multiple paths, which may interfere(constructively or destructively,depending on multiples of wavelength 30cm)

Telcos• Predict coverage, based on

antennas and propagation & terrain models• Measure actual coverage, e.g. with cherry picker tower /

monitoring & positioning equipment in boots of taxis• Produce “Cell Coverage Maps” indicating the expected

“dominant cell” for each point

Note: Devices are ambivalent to distance; only aware of signal strength

19


Outline



• Other locators• Who cares where you are?• Sources of location info• E911

• Summary and Questions

20


Who cares where you are?

Consumers• Where am I?• Where is the closest xyz?• Where is my daughter?

Telco• Derived from consumer demand• To customise content (e.g. ads for local businesses)• Capacity planning• New services, e.g. road traffic conditions• Obliged to help:

Emergency servicese.g. for people who are lost, or unable to

Law enforcement

21


Sources of location info

Image from optus.com.au: Homepage / Personal / Mobile / 3G Mobile / FindA; drawing from http://www.acma.gov.au/webwr/consumer_info/location.pdf

Cell identitye.g. Optus FindA service

Measurements of phone emanations• strength• timing• direction (in future, using steerable

antennas)Direction finding well established for

wildlife, military; but needs to be done live traditionally exceptional;only now potentially normal.

Positioning systems, e.g. GPS• Works best outdoors• Handset-based privacy through

handset control of disclosure

22


E911Telco provides address associated with caller to direct emergency

servicesFCC has Enhanced 911 (E911) for mobile & VOIP users

Legislation gives carriers choices:Location Popularity 67% within 95% withinhandset 60% 50m 150mnetwork 20% 100m 300mhybrid 20%

Timing:1996: Development started (pre 9/11, but never only for emergency services)1999: Wireless Communication and Public Safety Act2003: 100% of handsets due to be compatible; few carriers met schedule

Similar efforts in• Europe: “Coordination Group on Access to Location Information for

Emergency Services”; more concern for privacy• Australia: ACMA discussion paper in 2004

23


Summary

• Most current capacity to locate mobile phones due is to the cellular nature of communication• cells are a couple of km wide• 120O sectors around towers, with 20O grey areas• Choice between towers heavily influenced by terrestrial

“clutter”• Logs only record first (& recently last) cell for a call• System tracks, but doesn’t preserve, location area of phones

that are on• Location services are increasing in importance

• to customers• to telcos• to law enforcement...


Locating Users of Mobile Phones

Tim MoorsSenior Lecturer

School of Electrical Engineering and TelecommunicationsUniversity of New South Wales

Sydney, NSW, Australia

[email protected]

Questions?

Copyright © 2007, Tim Moors Locating Users of Mobile Phones Tim Moors Senior Lecturer School of...

Documents

Transcript of Copyright © 2007, Tim Moors Locating Users of Mobile Phones Tim Moors Senior Lecturer School of...