cellular continuity of operations options

Cellular Continuity of Operations Option

Jon R. Marcy

Sr. I.T. Consultant

Jon Marcy Consulting Services

March 4, 2013

[email protected]

1 Cellular Continuity of Operations Option


Table of Contents

Executive Summary ........................................................ 2

Requirements Definition ................................................ 3

Solution Option .............................................................. 3

GDIT Sectera Handset Compatibility .............................. 6

Antennas......................................................................... 6

Applications scenarios .................................................... 6

Portable GSM System Subscriber Grabbing Feature ...... 6

Portable GSM system with no/limited connectivity to PSTN 7

Portable GSM system connected to PSTN and Internet 8

Portable GSM system as a roaming GSM network ........ 9

Past Performance Examples ......................................... 10

Summary....................................................................... 12



Executive Summary

With the growing dependency on mobile

communications with the United States and

abroad, comes an emerging risk in the advent of a

manmade or natural disaster. Commercial cellular

networks are designed to support normal business

type operations, and are not equipped to support

sudden surges in use or meet the survivability

requirements that come with event that interrupts

or destroys these services.

This paper provides for a Commercial-Off-The-Shelf

(COTS) capability that has a proven track record in

support of both the Tsunami relief effort in

Indonesia and the Hurricane relief effort in New

Orleans in the aftermath of Katrina.

The technology is based on COTS Global System for Mobile (GSM) 3G technology that is

operational in over 80% of the globe today. Within the USA, companies such as AT&T and T-

Mobile both operate national GSM networks, and most 4G handsets today are dual-band and

work with 3G GSM frequencies. There are Enhanced Voice Data Only (EVDO) options to the

technology being presented in this paper, however EVDO technology is primarily limited to use

within the USA by companies such as Verizon and Sprint, and thus don’t represent an option

that can be deployed globally in support of emergency communications.

While many commercial cellular networks are being upgraded with 4G Long Term Evolution

(LTE), the LTE strategy represents the next generation of GSM. As such, most all LTE enabled

handsets are backwards compatible with GSM radios, as they are equipment with dual-band

radios. One of the baseline assumptions made during the development of this option was that in

the event of disaster recovery plan that the primary means of communications to be supported

would be voice, thus the focus was placed on the less expensive 3G technology.



Introduction

Pico-cell technology has been around for over 10 years, with systems being manufactured to

support both legacy GSM and EVDO bands. Companies such as Qualcomm and Motorola both

have rich histories in the development of EVDO radio technology, while GSM, being an

international standard, have international manufactures like Nokia-Siemens, Ericsson, and

others, to name a few. The primary difference between cellular pico-cell technology and their

larger commercial carrier grade cousins is the emitting power of the transmitters, and the

number of handsets they can support. Other than that, they are identical in both software and

radio technology.

Requirements Definition

The Department of Defense (DOD) needs to provide assured wireless communications that will

interoperate with existing commercial Global Systems for Mobile Communications (GSM)

wireless networks located within the United States and overseas. The wireless communications

system shall also provide the ability to monitor, as required, commercial GSM traffic collected by

the system. The cellular requirement includes a comprehensive wireless communications

system package consisting of:

• A secure GSM cellular system,

• Coverage for the operational areas covers approximately 2.4 square miles,

• Operate in the 900MHz & 1800MHz GSM spectrums,

• Support for 40 to 50 private subscribers/users (expandable to 200),

• Interface to an existing commercial or DOD telephone switch or communications

elements,

• System scalability in terms of capacity and features.

Solution Option

The components listed are compliant with DOD Directive 8100.2, and will interoperate with

commercial carrier GSM networks. The proposed solution will meet the basic operational

requirements stated in the above requirements definition. It will provide a private GSM wireless

communications system with the ability to passively collect commercial GSM traffic within the

range of the system. The system’s capacity will easily support 100 private users, and up to 200

subscribers & users depending on quality of service needs.

The ‘Field Deployable’ controller is a small, portable, light weight GSM network with limited

capacity that combines a software based GSM MSC (Mobile Switching Center), BSC (Base Station

Controller), SMSC (Short Messages Service Center), HLR (Home Location Register), VLR (Visitor

Location Register), IWF (Inter Working Function) and network management functions. The



system is designed specifically for deployment with small user groups, where limited traffic

capacity is required. Optional T1, FXO (4 ports included in basic system) and Modem backhaul

options are available to enable connectivity to the PSTN or a DSN PBX. Up to five picoBTS can be

connected to the Field Deployable controller through IP/Ethernet links. The picoBTS can

therefore be co-located with the controller or remotely connected by an IP/Ethernet

connection. The proposed rugged transit case includes one (1) controller and one (1) picoBTS.

Features:

• Provides remote GSM voice, secure voice and data solutions to small user groups

• Supports 7 simultaneous mobile to land calls (codec processing is limited by the PC

processor capacity) and up to 5 GSM TRX at 1800, 1900MHz. Mobile to mobile calls are

streamed directly between BTS’s as an IP stream; as such Mobile to Mobile call capacity

is limited to the number of available traffic channels

• Supports 9.8kbps circuit switched data

• Simple to use Browser Based Management interface

• Integrated PBX for local traffic routing

• Small, portable PC hardware platform

• Optional T1, FXO (4 ports included in basic system) and Modem ports support local

traffic routing

BSS: BSC software is licensed with the purchase of each picoBTS. The picoBTS is available at

900MHz, 1800MHz, 1900MHz

OS: Red Hat Linux 8.0 (2.4 kernel).

O&M: Integrated browser based interface for system configuration and management

Capacity: The Field deployable controller is capacity limited to 7 simultaneous mobile to land

calls – limited by the fixed processing capacity of the PC. Additional coverage may be made

available by deploying up to 5 GSM pico-cells.

Backhaul options: including T1, FXO (4 ports included in basic system) and Modem ports can be

added to provide alternative routing options. Note that up to two PCI modules can be

incorporated into the controller

Hardware Options: The capacity requirements for the Field Deployable controller are

determined primarily by the PC processor. Up to 7 simultaneous outgoing calls are available for

termination to an external network. Only two PCI modules may be installed in the Field

deployable unit: Options include

Additional BTS: Up to four (4) additional Pico cells may be deployed with the Field Deployable

controller. Each Pico cell comprises a single (1) nanoBTS and (1) BSC RTU (runtime) license.



Available frequency options include 900MHz, 1800MHz or 1900MHz. All frequency variants may

be deployed simultaneously if required

T1 module: Option comprises the T1 hardware module and appropriate SW license for a single

T1 port (23 channels) to allow clear call progression via a standard T1 interface. The T1 interface

supports clear calls only.

FXO module: Includes a 4 port FXO hardware module and the appropriate SW license for up to 4

x FXO ports for local routing to POTS lines. The FXO interface supports clear calls only.

Secure call module: The Option includes a 4 port modem module and the appropriate SW

license for the internal IWF to facilitate local routing of secure calls via POTS lines. The modem

PCI module supports secure calls only.

BTS Range Enhancement: This is a custom option which allows the pico-cell range to be

extended significantly. Additional Power Amplifiers and Antennas are quoted to implement this

option.

Architecture Schematic

Inherent Subscriber grabbing feature: All GSM cell phones will attempt to register to an

operational network. When the phone detects the control channel of the tactical network it will

transmit its IMSI to the network MSC/HLR or home location register. The 15 digit hexadecimal

number from the cell phone is compared to the HLR database. If the number does not have a

GSM FD Controller

• Software based MSC, BSC,

VLR, IWF and SMSc on PC

platform

• Clear and Secure traffic

routed via PBX or PSTN

• Optional GPRS

GGSN./SGSN for packet

data services

BTS

• 200mW 1800MHz

GSM pico-cell

• optional range

enhancement

Browser

• System

Management

• Packet Data

Services

Traffic

FXO/T1 to

PBX/PSTN



match within the HLR an error message will be sent back to the MSC and network BSS to

indicate "NO SERVICE"! The process that creates the NO Service can be monitored and from the

message string the cell phones IMSI number can be displayed and then entered into the tactical

systems HLR/subscriber database. A feature can also be added to capture a cell phone and add

it to the tactical network. More details are provided about this feature in a later section of this

document. More details about the grabbing feature are provided in later sections.

GDIT Sectera Handset Compatibility

The Sectera Secure Wireless Phone for GSM provides end-to-end high assurance

secure voice and data communications for GSM cellular networks operating in

the 1800/1900 MHz spectrum worldwide. The Sectera Secure Wireless Phone

has been certified by the National Security Agency (NSA) because of its ability to

protect classified information up to the Top Secret level using Type One

encryption algorithms available to authorized U.S. government personnel. This

phone complies with the U.S. Government sponsored Future Narrow Band

Digital Terminal (FNBDT) standards and will securely interoperate with other

FNBDT compatible devices. The optional Sectera Secure Wireless Phone consists of a state-of-

the-art Motorola Timeport GSM tri-band phone and the Sectera clip-in Secure Module that

provides the Type One high assurance end-to-end security.

Antennas

The following antennas will support the above solution:

� 3”±1” omni-directional with at least 0 dB gain and ground plane

� 12”±2” omni-directional with at least 3 dB of gain



� Corner reflector with at least 10 dB of gain

a. Azimuth beam angle to be between 30 and 40 degrees

b. Elevation beam angle to be between 40 and 50 degrees

Applications scenarios

The proposed GSM/GPRS system can operate in the 1800Mhz ETSI DCS (Digital Communication

System) band or 1900Mhz PCS (Personal Communication System) band. It can also support ETSI

900Mhz band. Many applications are possible for the portable GSM/GPRS (Global System for

Mobile Communication/General Packet Radio Service) system. The following are some “use case”

examples with first a description of how subscribers can be grabbed by the network.

Portable GSM System Subscriber Grabbing Feature

• Scan available PLMN’s (Public Land Mobile Networks)

o Identify and display available networks



o Identify and display the server and neighbor list for each PLMN

• Clone the required network

o Select the appropriate network and neighbor cell to clone (in most cases it is easier

to use the weakest neighbor to facilitate LU (Location Update))

• Manage subscriber information

o Populate list of IMSI’s (International Mobile Subscriber Identity) by allowing

handset to LU – reject the handset and build a list of available targets – identify

IMSI’s and IMEI’s (International Mobile Equipment Identity) and date stamp. Allow

the information to be saved and downloaded

o System user may identify target handset and selectively allow specific IMSI’s to

camp on the cloned network

o Allocate a temporary unique MSISDN (Mobile Station International ISDN Number) if

allowed to LU – this will not be SMS’d (Short Message Services) to target user

o Allow system user to call target handset to identify the user via the ring indicator –

no audio will be sent – and the call will terminate after 15 seconds – CLI (Calling

Line Identity) will indicate a private call

• Call routing

o When a target handset that is camped on the network initiates a call, route all

dialed numbers transparently via the FXO (analog RJ11/FXO port could be

backhauled by public cellular network as part of SPAWAR backhaul solutions)

o Allow use of * or # to prefix numbers for in network calling between ‘known’ users

o Allow users to specify how to treat emergency and special numbering schemes

• Call tracking/recording

o Provide the ability to record all calls and SMS messaged from a target handset –

this may be set on a per subscriber basis.

• User Interface

o Inverted color set for the GUI (Graphical User Interface) to white on black to reduce

the glare from the PC if used at night in a vehicle

Portable GSM system with no/limited connectivity to PSTN

In this scenario, the portable GSM system operates in standalone mode and does not or has only

limited TDM or analog connectivity to a PBX (Private Telephone Switch), the PSTN (Public

Switched Telephone Network) or some PLMN/HPLMN. The system is also not connected to the

internet so that GPRS service is not available. As soon as terminals detect a strong enough BCCH

(Broadcast Control Channel) signal they will attempt to register to the network. Under this

scenario the handsets will register to the internal HLR (Home Location Register) within the GSM

controller and according to one of the following modes:

• auto-registration, which attaches all handsets that attempt to register with the network

(e.g. Disaster recovery)

• manual subscriber registration, allowing only permitted IMSI's to attach

As the system might not have any connectivity to the public network, the operator might

require only certain users to register to the system. In this case manual registration would be



used so that access to this network is selective. The auto-registration feature could also be used

to determine if certain users are present in the coverage area. A specific dummy MNC (Mobile

Network Code) could also be allocated to these portable networks.

For the case where limited connectivity is required, it is also possible to use a public cellular

terminal on this configuration connected to an RJ11/FXO port on the controller in order to

backhaul the calls through the public cellular network. This terminal would be part of a Post,

Base, Camp, Station (P/B/C/S) backhaul solution. If a specific user has been grabbed by the

portable network and needs to be monitored, the RJ11/FXO port and the GSM terminal can

actually be associated with that user’s specific IMSI. This scenario provides a light monitoring

function when the monitoring and grabbing feature is implemented on the GSM controller.

As an example, a possible application for this configuration could be the monitoring of certain

members of a terrorist cell who use the public GSM system for communication and possibly to

detonate bombs. The portable system could be deployed to monitor a given area at specific

times with 25 US soldiers participating to the mission.

Portable GSM system connected to PSTN and Internet

The standard four ports FXO on the controller are used to interconnect to a PBX. A numbering

plan can then be implemented for the users on the portable GSM network so that incoming and

outgoing calls can be processed. With the FXO options on the GSM controllers, a POTS (Plain Old

Telephone Service) phone line is directly plugged into the interface card. POTS lines terminate to

the respective wire-line phone service provider. Outgoing calls are determined by setting

appropriate access numbers in the controller routing tables – for instance a ‘9’ may be used to

route calls to the FXO port. The prefix may be deleted before the digits are dialed and sent out

across the FXO. Each FXO will have a number assigned to it by the respective wire-line service

provider. The controller may be configured to allow access to only one MSISDN (as defined in

the local HLR) or to allow access to any MSISDN in the HLR by allowing a DTMF (Dual Tone Multi

Frequency) over-dial when a DTMF prompt is provided in the earpiece of the calling party



device. Any mobile subscriber on the portable GSM network can of course forward his public

MSISDN number to the POTS line allocated to him so that incoming calls can be received.

In this scenario it is also possible to use the optional GPRS core network function (SGSN/GGSN:

Serving GPRS Support Node/Gateway GPRS Support Node) and interconnect to the internet for

access to email and other data services. To implement the SGSN/GGSN function, a PCC (Packet

Core Controller) would have to be provisioned either locally or remotely. A Gb/IP (Interface

between BSC (Base Station Controller) and SGSN) interface would interconnect the primary

controller to the PCC. Up to 50 GPRS subscribers can be supported from a single PCC. The PCC

would then provide a IP interface to the internet and from which the secure email servers and

public internet could be accessed from the PDA’s. As with the limited connectivity scenario, this

scenario can also set a specific MNC for this network.

This network could be used to track specific users and substitute a public cell according to the

subscriber grabbing scenario described at the beginning of this section. As an example, a

possible application for this configuration could be the monitoring of certain individuals who are

part of the coalition but also suspected to collaborate with the Taliban in Afghanistan.

Portable GSM system as a roaming GSM network

In this case, the portable GSM system is used as a roaming network that could be deployed for

example for the support of natural disaster recovery operations. A specific MNC would be data

filled in these systems and recognized by all AT&T, T-Mobile and other public GSM carriers’

subscribers’ handsets. The system would interconnect to the MAP/SS7 (Mobile Application

Part/Signaling System No.7) signaling network and be able to process location area updates. The

system could also be provisioned with GPRS so that users can access their home GGSN and

standard portal for email and other data services. As the network is turned up the subscribers

would recognize it as being part of a valid roaming network and attempt to register. In this case

the HLR function of the portable system is not used for public subscribers. MAP/SS7 signaling

will trigger a location area update for all the users registering to the portable system and each

user profile will be downloaded into the VLR (Visitor Location Register) while the public network



HLR will be upgraded with the new location information for these users so that they can receive

and initiate calls and be charged for them. The system is using standard roaming procedures to

support this.

To implement MAP/SS7 signaling for the roaming network, a CGC (Central GSM Controller)

would have to be provided to interface the existing portable GSM networks to the SS7 GSM

network and the operator would have to obtain the relevant authorization to interconnect with

at least one GSM service provider.

A possible application for this configuration could be the support of disaster recovery operations

like hurricane Katrina. In this case a number of portable systems are deployed with

interconnectivity to the different HPLMN through the MAP/SS7 signaling gateway.

Past Performance Examples

The deployment of Pico-Cell technology has been used by the US Navy in two memorable

disaster relief efforts supported by the USNS Mercy and the USNS Comfort. In both cases, in

support of humanitarian aid missions, the availability of a deployable commercial GSM solution

resulted in saved lives.

In 2004, the Indian Ocean Tsunami came as a result of a record setting undersea earthquake,

which left over 150,000 dead in 11 different countries. The US Navy initially dispatched the USS

Abraham Lincoln to support logistics and communications requirements associated with the

distribution of aid and supporting the surge of Non-Government Official (NGO) personnel form

various non-profit medical teams. Within a week, the tactical radio systems aboard the USS

Abraham Lincoln could not keep up with communications demand, which resulted in the Pacific

Fleet Command ordering the USNS Mercy to the region in relief of the USS Abraham Lincoln. On

arrival, off the coast of Banda Ache, Indonesia the USNS Mercy deployed a portable GSM

capability on the deck of the ship that provided ship-to-shore communications between shore

based medical personnel and US Navy doctors and nurses aboard the USNS Mercy.



In 2005, New Orleans, LA took the brunt of a Category 4 Hurricane (e.g. Katrina) which

devastated the city and the surrounding coast line. The US Navy sent the USS Iwo Jima there to

provide Command and Control (C2) oversight of the rescue mission, coordinating rescue efforts

between the US Coast Guard and the various National Guard units who were deployed in

response of the disaster. In addition to the USS Iwo Jima, the Navy also deployed the USNS

Comfort to provide necessary emergency medical assistance to recovered survivors.

As part of the USS Iwo Jima mission, the US Navy deployed one vehicle mounted mobile GSM

system and two portable systems that were positioned on city building roof-tops to provide

GSM radio coverage over the flooded city. Using the “Subscriber Grabbing” feature, the GSM

system began capturing several commercial GSM handsets owned by survivors that were still

active. The US Coast Guard was able to use the GSM communications with survivors to pin-point

their locations for emergency recovery and for coordinating emergency medical response. With

many survivors trapped in their attics, it is believed the portable GSM technology was

responsible for saving thousands of lives.

Images from US Navy response to Indonesian Tsunami relief effort



Summary

Commercial GSM Pico-cell technology represents a realistic and cost effective solution for

providing an emergency response capability for DOD P/B/C/S facilities in times of either

manmade or natural disasters. With systems being capable of being packaged in ruggedized

containers or motorized vehicles, they can be rapidly deployed to any part of the globe to

support both disaster recovery and humanitarian efforts.

For more information on Cellular Continuity of Operations technology, please contract:


Ph: 540-323-7236

E-Mail: [email protected]

Web: http://jonmarcy.comcastbiz.net

Images from US Navy response to Hurricane Katrina relief effort

cellular continuity of operations options

Technology

mobile gsm

legacy gsm

gsm radios

generation of gsm

gsm spectrums

commercial gsm traffic

secure gsm cellular

portable gsm system