TechnoBin

eUICC



Terminal profile of phone

https://terminal-profile.osmocom.org/decode.php?tp=ffffffff7f9f00dfff03fe1fe21f7fe09fe90f000f00480001000000000800

https://terminal-profile.osmocom.org/


A very good reference point for network technology

http://blog.3g4g.co.uk/

SIM

http://resources.infosecinstitute.com/sim-card-forensics-introduction/



3G Communication

Fundamentals

Japan was the initiator of the 3G communication systems. Wideband CDMA proposed by NTTDoCoMo was a major improvement over the GSM system in terms of data delivery. The wireless market is driven by the huge growth of internet users. 3GPP - 3rd Generation Partnership Project, released R-99 in Dec 1999 which is the first release of WCDMA.  3G facilitates high speed data transfer. The 3G broadband is 5MHz bandwidth.

Some 3G protocols:





  • Universal Mobile Telecommunication Service (UMTS)
  • Wideband Code-Division Multiple Access (WCDMA)
  • High-Speed Downlink Packet Access (HSDPA)
  • Evolution Data Maximized (EVDO)

  • Spectrum allocation for WCDMA

    Uplink - 1920M- 1980M
    Downlink - 2110M-2170M

    Channel
    Dedicated pathway through a transmission medium for one user's information.

    Claude Shannon - Mathematical theory of Communication.
    Nicola Tesla - Developed Frequency Hopping Spread Spectrum around 1900

    CHIP - Pulse of a direct-sequence spread spectrum code.

    WCDMA Chip rate is 3.84 Mcps.

    UTRAN - Universal Terrestrial Radio Access Network performs all the functions related to wireless communication.
    Handover - shifting a mobile device's connection from one Node B to another.

    WCDMA power control
    Open loop power control - without feedback from NodeB
    Closed loop power control - with feedback from NodeB



    RF in communication

    Range : 3 kHz to 300 GHz

    Basis of Radio Technology : A conductor is radiated off into space as electromagnetic wave by the energy of RF current.RF is an alternating current which, if supplied to an antenna, will give rise to an electromagnetic field that propagates through space.
    In December 1901, Marconi performed his most prominent experiment, where he successfully transmitted Morse code from Cornwall, England, to St John’s, Canada.
    Antenna




    an antenna is designed to radiate radio energy into space and collect radio energy from space.an antenna is a pretty efficient device when compared to most other energy-emitting

    things we know.


    The most basic antenna we use in two-way base stations is the half-wave dipole radiator. The half-wave dipole is simply a straight conductor made of wire, rod, or tubing that, electrically,is one-half wavelength long.


    To be in phase the cables don’t have to be the exact same length. They can be of different lengths but they must differ by multiples of a full wavelength
    Gain is a measure of performance power.The reference we use in two-way base station antennas is the half-wave dipole and the unit of measure is the decibel.

    http://en.wikipedia.org/wiki/Radio_frequency
    http://www.ni.com/white-paper/3541/en
    http://docs.commscope.com/Public/about_rf_communications.pdf
    http://www.ti.com/lit/ml/slap127/slap127.pdf
    http://paginas.fe.up.pt/~mleitao/CMOV/Teoricas/CMOV_GSM.pdf

    GSM Basics:

    GSM has revolutionised the telecommunication world. Fixed, wired telephones to mobile telephony is a paradigm shift that has changed our lives. For a user, the Mobile Station , which includes the mobile equipment (cell phone/mobile phone) and the SIM is the most familiar entity of the huge network lying behind a call or message, and SIM is the best-known database. A SIM, though tiny, has a lot of information stored in it. It identifies the user (assume it as an id card of the phone), it has a list of available networks, tools needed for authentication and ciphering and may contain memory space for storage eg, messages.

    Below are few videos from YouTube which I find extremely helpful in understanding GSM.










    There are three subsystems in GSM network
    • NSS- Network Switching Subsystem
    • BSS- Base Station Subsystem
    • NMS-Network Management Subsystem


    Network Switching Subsystem(NSS):

    The main functions of NSS are:
    • call control - subscriber identification, establishment of a call and disconnecting the network once call is over.
    • charging/billing.
    • location  management - subscriber's location.
    • subscriber data handling- HLR (permanent ) , VLR(temporary)
    Main elements of Network Switching Subsystem :
    • MSC - Mobile Services Switching Center
    • VLR - Visitor Location Register
    • HLR - Home Location Register
    • AC - Authentication Center
    • EIR - Equipment Identification Register
    Mobile Services Switching Center:
    It does call control, Initiation of paging- its the process of locating a particular mobile station in case of a mobile terminated call, and collection of charging data.
    VLR:
    It contains information about the subscribers like : Identification numbers, security information for authentication of the SIM and ciphering, and services the particular subscriber can use. This is a temporary database i.e, data is held only as long as the subscriber is in its sevice area. It contains address to every subscribers HLR.
    HLR:
    HLR maintains a permanent register of the subscribers. It also keeps track of the current location of its customers. 
    AC:
    It does the verification of the SIM cards,
    EIR: 

    EIR used for IMEI checking and contains three lists



    • white list
    • gray list
    • black list
    Base Station Subsystem(BSS):

    It manages the radio network. One MSC contains several BSS. BSS covers large area consisting of several cells. BSS consists of the following:
    • BSC -Base Station Controller
    • BTS- Base Transceiver Station
    • TC-Transcoder.
    Main Tasks of BSS:
    • Radio Path Control - radio channel allocation and quality of Radio channel
    • Synchronisation- MSC synchronises BSS and BSS synchronises BTS. BSC does the synchronisation inside BSS.
    • Air and a-interface signalling
    • Connection establishment between MS and NSS - signalling or traffic connection.
    • Mobility management and speech transcoding.-
    BSC(Base Station Controller)
    This is the central network element of Base Station Subsystem. It controls the radio network. Main tasks of BSC are



    1. Connection establishment between MS and NSS. All calls from MS are established through the group switch of BSC.
    2. Mobility management-It initiates majoirty of handovers.
    3. Statistical raw data collection- Informatin from BTS, transcoders and BSC are collected and forwarded via Data Communication Network to Network Management Subsystem.
    4. Air and A-interface signalling support.
    5. BTS and TC Control. BSC is capable of barring a BTS from the network and collecting alarm information. It also collects alarms related to transcoders.
    BTS (Base Transceiver Station)


    Difference between CDMA and TDMA:
    Imagine a room full of people, all trying to carry on one-on-one conversations. In TDMA each couple takes turns talking. They keep their turns short by saying only one sentence at a time. As there is never more than one person speaking in the room at any given moment, no one has to worry about being heard over the background din. In CDMA each couple talks at the same time, but they all use a different language. Because none of the listeners understand any language other than that of the individual to whom they are listening, the background din doesn't cause any real problem.


    http://www.arcx.com/sites/cdmavstdma.htm


    http://www.roggeweck.net/uploads/media/Student_-_Introduction_to_GSM.pdf
    http://www.roggeweck.net/uploads/media/Student_-_GSM_Architecture.pdf


    GSM

    C and C++

    ClearCase


    Cloud Computing


    Acronyms for easy reference
    • A
    ADC Analog  to Digital Converter
    www.national.com/appinfo/adc/files/ABCs_of_ADCs.pdf
    ---------------------------------------------------------------------------------
    AFC Adaptive frequency correction/automatic frequency correction
    ---------------------------------------------------------------------------------
    ARFCN Absolute Radio Frequency Channel Number
    http://www.aubraux.com/design/arfcn-calculator.php?sf=935&bw=200&co=&arfcn1=1&arfcn2=124&table
    ----------------------------------------------------------------------------------
    AGCH-Access Grant Channel
    http://www.mobile-phone-directory.org/Glossary/A/AGCH.html
    ----------------------------------------------------------------------------------
    ASIC- Application Specific Integrated Circuit.
    ASK-Amplitude Shift Keying
    AMR-Adaptive Multi Rate.
    ACELP- Algibraic Code Excited Linear Prediction
    AMR-Adaptive Multirate
    AEM-Application Enhanced Modem
    AFS-AMR Full Rate Speech
    AHS-AMR Half Rate Speech
    ACS-Active Codec Set
    API-Application Programming Interface
    ASIC-Application Specific Integrated Circuits
    ASSP-Application Specific Standard Products
    AGC-Automatic Gain Control
    • B
    BCCH Broadcast Control Channel
    BSC Base Station Controller
    BTS Base Transceiver Station
    BSS-Base Station Subsystem
    BS-Base Station
    BSIC-Base Station Identity Code.
    BCC-Base Station Colour Code
    BSF-Base Station Control Function
    BLER-Block Error Ratio
    BIST - Built In Self Test
    • C
    CBCH-Cell Broadcast Channel
    C/I- Carrier to Interference Ratio
    CAIT- CDMA Air Interface Tester
    CSSR- Call Setup Success Rate
    CLI-Command Line Interface
    CMC-Codec Mode Command
    CMI-Codec Mode Indication
    CMR-Codec Mode Request
    CCXO-Capacitor Controlled Crystal Oscillator
    COT-Chip On Tape
    CPS-Cellular Protocol Stack
    CAT-Configurable Analogue Transistor
    CRC - Cyclic Redundancy Check
    A cyclic redundancy check (CRC) is an error-detecting code commonly used in digital networks and storage devices to detect accidental changes to raw data. Blocks of data entering these systems get a short check value attached, based on the remainder of a polynomial division of their contents; on retrieval the calculation is repeated, and corrective action can be taken against presumed data corruption if the check values do not match. - from Wikipedia
    D
    DCH Dedicated Channel
    DSDS Dual SIM Dual Standby
    DSP Digital Signal Processor
    DCCH- Dedicated Control Channel
    DCS- Digital Cellular System
    DTX-Discontinuous Transmission
    DRX-Discontinuous Reception
    DECT-Digital Enhanced Cordless Telecommunication
    DMT-Discrete Multitone Modulation
    DUT-Device Under Test
    DTM-Dual Transfer Mode
    DTS-Darp Test Scenarios
    DCR-Direct Conversion Radio Transceivers
    DLL-Dynamic Linked Library
    DSC-Digital Signal Controller
    • E
    EDGE- Enhanced Data Rates for GSM Evolution
    EIRP- Equivalent Isotropically Radiated Power
    ESN-Electronic Serial Number
    ESMR-Enhanced Specialised Mobile Radio
    ETSI- European Telecommunications Standards Institute
    EIR-Equipment Identity Register
    EMMI- Electrical Man Machine Interface
    EEP-Electrically Erasable Programmable Read Only Memory
    EDR-Enhanced Data Rate
    EC-Echo Canceller
    ETM - Embedded Trace Macrocell
    ETB- Embedded Trace Buffer
    • F
    FACCH-Fast Associated Control Channel
    FAKEY-Fully Automated Key
    FCB Frequency Correction Burst
    FW Firmware
    FM-Frequency Modulation
    FDD-Frequency Division Duplex
    FSPL-Free Space Path Loss
    FDM-Frequency Division Multiplexing
    FEM-Front End Module
    FPGA-Field Programmable Gate Arrays
    FFS-Flash File System
    • G
    GSM Global System for Mobile communication
    GPRS General Packet Radio Service
    GGSN-Gateway GPRS Support Node
    GMSK- Gaussian Minimum Shift Keying
    GPS- Global Positioning System
    GHOST- GSM hosted SMS Tele Service
    GCAL- GSM Calibration Interface
    GTI-Generic Test Interface
    GIC- Generic Instrument Control
    GPIO-General Purpose Input Outputs
    GMTS-Generic Module Test System
    GDD-Graphic Device Driver
    GSI-GSM System Interface
    GPIB-General Purpose Interface Bus
    • H
    HISR High level Interrupt Service Routine
    HW Hardware
    HDML- Handheld Device Markup Language
    HSCSD- High Speed Circuit Switched Data.
    HLR- Home Location Register
    HSN-Hopping Sequence Number
    HCI- Host Controlled Interface
    HID-Human Interface Devices
    HFP-Hand-free Profile
    • I
    ICCID-Integrated Circuit Card ID
    iDEN-Integrated Digital Enhanced Network
    IRDB-Intelligent Roaming DataBase
    IMEI-International Mobile Equipment Identifier
    IMSI-International Mobile Subscriber Identifier
    ITU-International Telecommunication Union
    ISR-Interrupt Service Routine
    ICM-Initial Codec Mode
    INL-Inline Mode
    ICT-Information and Communication Technology
    • J
    JTAG - Joint Test Action Group
    • K
    KPI-Key Performance Indicators
    • L
    LISR Low level Interrupt Service Routine
    LAPD- Link Access Protocol on D Channel
    LAPDm-Link Access Protocol on Dm Channel
    LAI-Location Area Index
    LAC-Location Area Code
    LOS-Line Of Sight
    LTE-Long Term Evolution
    LLT-Low Level Trace
    LAS-Logical Address Space
    LMT-List Mode Test
    LUXO-Linearisation Unit for Crystal Oscillator
    LNA-Low Noise Amplifiers
    LUT-Look Up Tables
    LDAP-Lightweight Directory Access Protocol
    • M
    MSK-Minimum Shift Keying
    MA-Mobile Allocation
    MAIO-Mobile Allocation Index Offset
    MCC-Mobile Country Code
    MNC-Mobile Network Code
    MSISDN-Mobile Subscriber ISDN Number
    MS-Mobile Station
    MOC-Mobile Originated Call
    MTC-Mobile Terminated Call
    MSC-Mobile Switching Center
    MAC-Medium Access Control
    MELM-Multi Evaluation List Mode
    MI_DL-Mode Indication in Downlink Direction
    MC_DL-Mode Command in Downlink Direction
    MI_UL-Mode Indication in Uplink Direction
    MR_UL-Mode Request in Uplink Direction
    MOSFET-Metal Oxide Semiconductor Field Effect Transistor
    • N
    NB Normal Burst
    NCELL Neighbor cell
    NSS-Network Switching Subsystem
    NCC-Network Colour Code
    NMR-Network Measurement Reports
    NVM-Non-Volatile Memory
    NSR-Noise to Signal Ratio
    NSTM-Non Signalling Test Mode
    NR-Noise Reduction
    • O
    OSC Oscillator/One Second Calibration
    OSS-Operations Support System/Operation Sub System
    OFDM-Orthogonal Frequency Division Multiplexing
    OHA-Open Handset alliance
    OSF-Optimal Smartphone Framework
    OnCE- On Chip Emulation
    • P
    PLL Phase Locked Loop
    PLMN Public Land Mobile Network
    PTM Packet Transfer Mode
    PCM-Pulse Code Modulation
    ppm-parts per million
    PAN Personal Area Network
    PCS- Personal Communication Services
    PIN-Personal Identification Number
    PDC-Personal Digital Cellular
    PCH-Paging Channel
    PSWR-Power Standing Wave Ratio.
    PSK-Phase Shift Keying
    PAM-Pulse Amplitude Modulation
    PCM-Pulse Code Modulation
    PDP-Packet Data Protocol
    PDU-Protocol Data Units
    PSTN-Public Switched Telephone Network
    PIXIT-Protocol Implementation Extra Information Required For Testing
    PCL-Power Control Level
    PWM-Pulse Width Modulation
    PMIC-Power Management Integrated Circuits
    PRBS-Pseudo Random Binary Sequences
    PoC-Push to talk over Cellular
    PGA-Programmable Gain Amplifier
    PMU-Power Management Unit
    • Q
    QAM-Quadrature Amplitude Modulation
    • R
    RACH-Random Access Channel
    RF Radio Frequency
    RRC Radio Resource Management Controller
    RSSI-Received Signal Strength Indicator
    In telecommunications, received signal strength indicator (RSSI) is a measurement of the power present in a received radio signal. - From Wikipedia

    RLC-Radio Link Control
    RLP-Radio Link Protocol
    RATSCCH-Robust AMR Traffic Synchronised Control Channel
    RoHS-Restriction of Hazardous Substances
    RTL-Register Transfer Level
    RSCP - Received signal code power
    In the UMTS cellular communication system, received signal code power (RSCP) denotes the power measured by a receiver on a particular physical communication channel. It is used as an indication of signal strength, as a handover criterion, in downlink power control, and to calculate path loss. In CDMA systems, a physical channel corresponds to a particular spreading code, hence the name (Received signal code power). - From Wikipedia
    • S
    SB Synchronization Burst
    SCELL Serving Cell
    SDHB System Development Handbook
    SI System Information
    SIM Subscriber Identification Module
    SDR- Software Defined Ratio
    SDCCH-Stand Alone Dedicated Control Channel
    SACCH-Slow Associated Control Channel
    SMS-Short Message Service
    SNR-Signal To Noise Ratio
    SDK-Software Development Kit
    SRAM-Static RAM
    SIO-Serial Input Output
    SB-Synchronisation Burst
    SMD-Surface Mounted Devices
    • T
    TDMA- Time Division Multiple Access
    TCH-Traffic Channel
    TA-Timing Advance
    TCHf-Full rate Traffic Channel
    TCHh-Half rate Traffic Channel
    TDM-Time Division Multiplexing
    3GPP- Third Generation Partnership Project
    TSC-Training Sequence Code
    • U
    UE1 User Equipment
    UMTS-Universal Mobile Telecommunication System
    UWB-Ultra Wide Band
    UTRAN-Universal Terrestrial Radio Access Network
    UTA-Universal Terminal API.
    • V
    VSWR- Voltage Standing Wave Ratio
    VLR-Visitor Location Register
    VNA-Vector Network Analyser
    VOBS- Versionised Object Spaces
    • W
    WAP- Wireless Application Protocol

    http://www.mobiledia.com/glossary/27.html