Showing posts with label cell location. Show all posts
Showing posts with label cell location. Show all posts

Sunday, January 27, 2019

Cell Site Analysis - location and radio coverage signals

It still holds true with LTE radio coverage that signals arrive in a scattered manner detected at the mobile phone handset. A good CSA investigator will know how to explain how coverage might inconceivably be thought by the untrained not to be detected at a particular location, may well be possible due to the location of the phone at the material time.
 
As mentioned in a previous post understanding density of masts in an area must equally be understood not simply from the point of calls handled by a single mast. There is also the instance where a call's start and end masts are different that can be involved, which may involve the network having to deal with 'hard handover'. Advancements with 3G and 4G enables calls (data) being handled by several masts delivering data to the smartphone in a seamless fashion. This maybe due to the amount of data involved or fast-fading etc. These types of handovers are called 'soft-handover'. When understood correctly the use of these combined masts in soft-handover because they are often in very close proximity can narrow down the location through improved triangulation (etc.). 
 
 
There is the occasion where the operator only has one mast in a particular area but several sectors of the same mast might be used seamlessly for an e.g. data call, and this is called softer-handover. When thinking about soft and softer handover think in terms of 'inter' and 'intra'.
 
 
 
Furthermore, smartphones, which I call 'ultra-smarts' due to their increased embedded communications capabilities, use close proximity masts or access points (Wi-Fi) to enable uninterrupted communication and network access. Network operators have deployed microcells, as you (may) know. Microcells deployment help remove the burden of signalling and traffic on macro-cells by directing slow-moving mobiles to short range coverage. These microcells can be useful for slow-moving users, walking down the high street or located in one area for a period of time. Remaining in an area for a period of time is called 'dwell time'. The latter is a term CSA investigators should know as it can have important bearing upon a case. In some instances, small coverage points have been deployed called pico-cells and nano-cells which can refine location distances between the mobile phone and the cell to a few meters.
 
The 'ultra-smarts' Wi-Fi capability creates an additional attractive proposition for cell site analysis investigations as the investigator will need to be keenly aware that dual usage of cellular and Wi-Fi coverage can produce a rich resource of location positioning. The image below has been used at this blog before but it is still a useful reminder what should be considered when conducting radio surveys.
 
 
And if further illustration is needed to illuminate a survey assessment criteria then hopefully this image below will provide the investigator with some ideas.
 
 
Cell site analysis has evolved so much more from the days of GSM and early days of WCDMA. It is not enough to use call records and CDRs in isolation and/or going to a particular geographical location to conduct tests at one single location; the wider area needs to be taken into context as to what impact that might have on a call or calls being handled by a cell or cells etc. (mast, masts or access points).
 

Sunday, March 30, 2014

cdma2000 CSA radio test measurements

Recording the test results from CSA radio test measurements, whether the transmission technology be e.g. GSM, CDMA, WCDMA and/or LTE, it is perhaps a common thought that the data can be output and presented in a uniform format irrespective of the transmission technology. That would be all well and good were it the case that there had been set down an agreement for CSA regarding the components that only need to be provided. However, there is no such formal forensic best practice, evidential regulation or legislative directive that prescribes this. The fact that there is lack of agreement isn't such a problem and is probably a good thing because the components acquired for CSA are constantly evolving and changing and therein, for anyone conducting CSA, is the requirement to constantly and continuously identify:

a0 - The relevant transmission technology(ies) under investigation (MS may use several cellular technologies)

a1 - The relevant transmission capability of the mobile terminal and the profiling of any (U)SIM/R-UIM

a2 - The relevant technical capability of BSS/BTS and arrangements defined at a particular mast/tower

a3 - The relevance of any legacy technology/influences operating at the material time

a4 - How the above impacts on the information that is recorded in the call records/cell site details

Where cdma2000 1x, cdma2000 1x EV-DO or cdma2000 1x EV-DV might be in use it may be that cross-referencing the radio test measurement results to corroborate the information recorded in the call records might nor always be possible. Moreover, depending upon the information dissemenation, it can be a law enforcement officer, private investigator or court/attorney the person to whom their enquiries are made for information that person may have no clue what information is available or have a limited understanding.

For those conducting cell site analysis, the identification of cell coverage and each cell's parameters detected at a particular point within a surveyed land-parcel is an important procedure. Commonly, a person conducting CSA within a cdma2000 radio demesne might seek network operator identity, radio area network identity, base station identity and cell/sector. There are various cdma standards, but for the purposes of this discussion the combination of detail that can be preferred is the combination of SID/NID/base_id/Ref_PN. I use the reference cdma2000 standard adopted for this discussion:

3GPP2 C.S0022-A v1.0 Date: March 2004
Position Determination Service for cdma2000 Spread Spectrum Systems

Provide Pilot Phase Measurement Page 2-55
2.2.4.2.6 Provide Pilot Phase Measurement (‘0101’)
If RESP_TYPE is equal to ‘0101’ (Provide Pilot Phase Measurement), RESP_PAR_RECORD shall include the following variable-length record:

Table Page 2-56




This standard defines an MS to capture and compile the SID/NID/base_id/Ref_PN along with other details but the standard does not specify how this information may be translated so that a CSA examiner can illustrate the uniqueness of a particular cell/sector. It is known that an important component for CSA that the examiner endeavours to report the cell and sector upon which MS mobile communications may be/have been routed from a particular location within a land-parcel.

Balancing the issues of the material time technology vis-a-vis legacy technology; a useful starting point appears to be June 2004 when the CDMA mobile industry focus groups discussed and reached a consensus that the inclusion of SID/NID/base_id/Ref_PN would provide the broadcast parameters for identifying a unique cell/sector. That is in relation to Position Determination Services. From my research library of historical reports and papers I note:

Terry Jacobson (Lucent Technologies) comments in X.P0024 (June 8th 2004) ".....this contribution recommends that the Pilot PN information be used (in addition to the SID, NID and BASE_ID) to uniquely identify a cell/sector. Specifically, that the REF_PN parameter be added (see C.S0022-A v1.0 page 2-53) to the SID, NID and BASE_ID as the parameters that identify the serving cell/sector. The REF_PN is a 9-bit information element indicates the “PN sequence offset of the pilot used by the mobile station to derive its time reference, relative to the zero offset pilot PN sequence in units of 64 PN chips”." 

Ref-PN as stated in 3GPP2 C.S0022-A v1.0 Date: March 2004



 So at what point would an MS communicate the measurements to the network? The standard set outs:

 
CSA examiners should read the relevant paragraphs of 3.2.2 as it reminds examiners of issues associated with 'not supported' in legacy technology.  Moreover, take care when considering what information is being measured in Idle Mode, Mobile Originated Call (send call) and Mobile Terminated Call (received call).

Subject to the collection of location components identified in this discussion actually being supported by the various technologies highlighted above, it is clear that it is possible for MS to collate the measurement results in order to send those measurements to the network. This suggests the test handset used for any radio test measurements should be able to display the combination of SID/NID/base_id/Ref_PN that should assist the examiner identify a unique cell/sector of a particular mast/tower.

The above discussion is not definitive and does not cover every aspect of cdma2000 cell site analysis. The discussion highlights one area of knowledge that may be helpful to a possible investigation by a CSA examiner.