OpenBTS

OpenBTS (Open Base Transceiver Station) is a software-based GSM access

OpenBTS
point, allowing standard GSM-compatible mobile phones to be used as SIP
endpoints in Voice over IP (VoIP) networks. OpenBTS is open-source software
developed and maintained by Range Networks. The public release of OpenBTS is
notable for being the first free-software implementation of the lower three layers of
the industry-standard GSM protocol stack. It is written in C++ and released as free
software under the terms of version 3 of theGNU Affero General Public License.

Contents
Open GSM infrastructure
History
Platforms
Security Stable release 4.0 / March 26,
Field tests 2014
Burning Man
Repository github.com
"RELIEF" Exercises
Niue /RangeNetworks
Defcon 20 /dev
See also
References Written in C++
External links Operating system Unix-like
Type GSM protocol
stack
Open GSM infrastructure License GNU Affero
OpenBTS replaces the conventional GSM operator core network infrastructure General Public
from layer 3 upwards. Instead of relying on external base station controllers for License[1]
radio resource management, OpenBTS units perform this function internally.
Website OpenBTS
Instead of forwarding call traffic through to an operator's mobile switching center,
OpenBTS delivers calls via SIP to a VOIP soft switch (such as FreeSWITCH or yate) or PBX (such as Asterisk). This VOIP switch
or PBX software can be installed on the same computer used to run OpenBTS itself, forming a self-contained cellular network in a
ger networks[2]
single computer system.Multiple OpenBTS units can also share a common VOIP switch or PBX to form lar

The OpenBTS Um air interface uses a software-defined radio transceiver with no specialized GSM hardware. The original
implementation used a USRP from Ettus Research, but has since been expanded to support several digital radios in implementations
ranging from full-scale base stations to embeddedfemtocells.

History
The project was started by Harvind Samra and David A. Burgess[3] with the aim of the project to drastically reduce the cost of GSM
service provision in rural areas, the developing world, and hard to reach locations such as oil rigs.[4] The project was initially
conducted through Kestrel Signal Processing, the founders' consulting firm.
On September 14, 2010, at the Fall 2010 DEMO conference, the original authors launched Range Networks as a start up company to
commercialize OpenBTS-based products.[5]

In September 2013, Burgess left Range Networks and started a new venture called Legba[6] and started a close collaboration with
Null Team SRL, the developers ofYate. In February 2014, Legba and Null announced the release of Y
ateBTS, a fork of the OpenBTS
project that uses Yate for its control layers and network interfaces.

Platforms
A large number of experimental installations have shown that OpenBTS can run on extremely low overhead platforms. These
including some CDMA handsets - making a GSM gateway to a CDMA network. Computer security researcher Chris Paget reported
[7] that a handheld device, such as an Android phone, could act as a gateway base station to which handsets can connect; the Android
device then connects calls using an on-boardAsterisk server and routes them to thePSTN via SIP over an existing 3G network.

Security
At the 2010 DEF CON conference, it was demonstrated with OpenBTS that GSM calls can be intercepted due to the fact that in GSM
[8]
the handset does not authenticate the base station prior to accessing the network.

OpenBTS has been used by the security research community to mount attacks on cellular phone baseband processors.[9] Previously,
investigating and conducting such attacks was considered impractical due of the high cost of traditional cellular base station
equipment.

Field tests
Large scale live tests of OpenBTS have been conducted in the United States in Nevada and northern California using temporary radio
licenses applied for through Kestrel Signal Processing andRange Networks, Inc.

Burning Man
During the Burning Man festival in August 2008, a week-long live field test was run under special temporary authorization
license.[10][11] Although this test had not been intended to be open to Burning Man attendees in general, a number of individuals in
the vicinity succeeded in making real out-going calls after a mis-configured Asterisk PBX installation allowed test calls prefixed with
an international code through.[12] The Burning man test successfully connected about 120 phone calls to 95 different numbers in area
codes over North America.

At the 2009 Burning Man festival, a larger test setup was run using a 3-sector system.[13] For the 2010 festival, an even larger 2-
sector 3-carrier system was tested.

At the 2011 festival, the OpenBTS project set upa 3-site network with VSAT gateway and worked in conjunction with the Voice over
IP services company Voxeo to provide much of the off-site call routing.[14][15]

"RELIEF" Exercises
RELIEF is a series of disaster response exercises managed by the Naval Postgraduate School in California, USA.[16] Range
1 [17] and February 2012.[18]
Networks operated OpenBTS test networks at the RELIEF exercises in November 201

Niue
During 2010, an OpenBTS system was installed on the island of Niue and became the first installation to be connected and tested by
a telecommunication company. Niue is a very small island country with a population of about 1,700 - too small to attract mobile
telecommunications providers. The cost structure of OpenBTS suited Niue, which required a mobile phone service but did not have
[19]
the volume of potential customers to justify buying and supporting a conventional GSM basestation system.

The success of this installation and the demonstrated demand for service helped bootstrap later commercial services. The OpenBTS
installation was later decommissioned ~February 2011 by Niue Telecom, a commercial grade GSM 900 network with Edge support
was instead launched few months later (3x sites in Kaimiti O2, Sekena S2/2/2 and Avatele S2/2/2) this provided full coverage around
the island and around the reef, the installation included a pre-pay system, USSD, Int. SMS and new Int. Gateway
.

Defcon 20
From July 26 to July 29, 2012, the Ninja Networks team set up a "NinjaTel Van" in the Vendor[20] area of Defcon 20 (at the Rio
Hotel/Casino in Las Vegas.) It used OpenBTS andserved a small network of 650GSM phones with custom SIM cards.[21]

See also
Base station subsystem
Um interface
USRP
GNU Radio
OsmocomBB

References
1. "OpenBTS - SVN" (https://archive.is/20121220052757/https://wush.net/trac/rangepublic/browser/openbts/trunk/LEG
AL). Archived from the original (https://wush.net/trac/rangepublic/browser/openbts/trunk/LEGAL)on 2012-12-20.
2. "RELIEF 12-2 : Actual Event"(http://wush.net/trac/rangepublic/wiki/RELIEF12-2#ActualEven)
. OpenBTS wiki.
Retrieved 11 April 2012.
3. Bort, Julie. Burning Man's open source cell phone system could help save the world
(http://www.networkworld.com/n
ews/2010/083010-open-source-voip-cell-phones-at-burning-man.html) , Network World, August 30, 2010. Retrieved
December 6, 2011.
4. Naone, Erica. Build Your Own Cellular Network(http://www.technologyreview.com/communications/25107/?a=f),
Technology World, May 2010. Retrieved on December 7, 2011.
5. Takahash, Dean DEMO: Range Networks rings in cell-phone service for $2 a month(https://venturebeat.com/2010/0
9/14/demo-range-networks-cheap-cell-phone-service/)VentureBeat, September 14, 2010. RetrievedDecember 6,
2011.
6. Finley, Klint Out in the Open: This super-cheap cellphone network brings coverage almost anywhere
(https://www.wir
ed.com/2014/06/openbts/)Wired, June 9, 2014.
7. Paget, Chris. OpenBTS on Droid (http://www.tombom.co.uk/blog/?p=144), Chris Paget's Blog, February 19, 2010.
Retrieved Dec. 6 2011.
8. Paget, Chris. Practical Cellphone Spying(https://www.defcon.org/html/defcon-18/dc-18-speakers.html#Paget), DEF
CON 18, July 30, 2010. Retrieved Dec. 6 2011.
9. Claburn, Thomas. Google Bets $20,000 You Can't Hack Chrome (http://www.informationweek.com/news/security/vul
nerabilities/229201164), Information Week, February 04, 2011. Retrieved December 6, 2011.
10. Federal Communications Commission,WD9XKN (http://openbts.sourceforge.net/FieldT est/WD9XKN.pdf)
Experimental Special Temporary Authorization, August 24, 2008. Retrieved December 6, 2011.
11. Burgess, David. The OpenBTS Project - an open-source GSM base station(https://lwn.net/Articles/297038/)
LWN.net, September 4, 2008. Retrieved December 6, 2011.
12. The Unofficial Non-Carrier of Burning Man 2008 (http://openbts.sourceforge.net/FieldT
est/) OpenBTS website.
Retrieved December 6, 2011.
13. Burgess, David. OpenBTS Nevada Test Site (http://openbts.sourceforge.net/FieldT
est2/Astricon2009DBurgess.key.p
df) Astricon 2009, October 13, 2009. Retrieved December 7, 2011.
14. Burgess, David. "Papa Legba 2011 - Network"(https://web.archive.org/web/20111202105602/http://papalegba2011.
wikispaces.com/Network). Archived from the original (http://papalegba2011.wikispaces.com/Network)on December
2, 2011.
15. Burgess, David. Burning Man 2011 - Yes we were there (http://openbts.blogspot.com/2011/09/burning-man-2011-ye
s-we-were-there.html) The OpenBTS Chronicles, September 6, 2011. Retrieved on December 7, 2011.
16. "RELIEF" (http://www.nps.edu/Academics/Schools/GSOIS/Departments/IS/Research/FX/RELIEF/relief.html)
. Naval
Postgraduate School. Retrieved 11 April 2012.
17. "RELIEF 12-1 Quicklook Report"(http://www.nps.edu/Academics/Schools/GSOIS/Departments/IS/Research/FX/doc
s/RELIEF12-1_QLR.pdf)(PDF). Naval Postgraduate School. Retrieved 11 April 2012.
18. "RELIEF 12-2 Quicklook Report"(http://www.nps.edu/Academics/Schools/GSOIS/Departments/IS/Research/FX/doc
s/RELIEF12-2_QLR.pdf)(PDF). Naval Postgraduate School. Retrieved 11 April 2012.
19. Burgess, David. FAKALOFA LAHI ATU (http://openbts.blogspot.com/2010/03/fakalofa-lahi-atu.html)
, The OpenBTS
Chronicles, March 7, 2010. Retrieved on December 7, 2011.
20. "At Defcon, hackers get their own private cell network: Ninja el"
T (https://arstechnica.com/security/2012/07/ninja-tel-h
acker-phone-network/). Ars Technica. 2012-07-28. Retrieved 2012-08-02.
21. "A Phone Network Just for Hackers"(https://blogs.wsj.com/digits/2012/07/26/a-phone-network-just-for-hackers/)
.
Wall Street Journal. 2012-07-26. Retrieved 2012-08-02.

External links
Official website

Retrieved from "https://en.wikipedia.org/w/index.php?title=OpenBTS&oldid=875134433

"

This page was last edited on 24 December 2018, at 01:43(UTC).

Text is available under theCreative Commons Attribution-ShareAlike License ; additional terms may apply. By using this
site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of theWikimedia
Foundation, Inc., a non-profit organization.