Any good picocell/femtocell cellphone base station USB dongles? - Page 1
Forum section: electronics / rf-microwave

author: Ben321
author_rank: Frequent Contributor
timestamp: June 15, 2019, 07:56:20 am
content: GSM, CDMA2000, and other cellphone technologies use published standards. Now instead of transmitting at 100 watts of power from a cellphone tower, like the professional cell service provider companies, what if I instead had a small dongle that operated at FCC Part 15 low power levels for unlicensed devices (think in the range of 1 to 10 milliwatts)? Such a signal could theoretically provide cellphone service up to maybe 20 to 50 feet from the transmitter. A small area of cellphone service coverage like that is known as a "picocell" or "femtocell". That would be really cool. If for example I had a USB dongle that could do that.If I brought my cellphone within range of the dongle, it could lock onto the signal from the dongle, and my cellphone would then have service from that dongle. Of course, it wouldn't be able to reach any landlines, because (unlike with normal cellphone service companies) such a dongle wouldn't bridge the wireless phone system to the landline phone system. However, any phones that had locked onto the signal from the dongle could communicate with each other, like walkie talkies, but with the advantage of having a FULL DUPLEX conversation between the cellphones (unlike walkie talkies with PTT that only are half duplex). The provided software and drivers for the dongle would allow you to set the phone number of any phone that was on the femtocell. When a phone communicates with a base station it sends its wireless serial number to that base station. The software would let you then assign a phone number to that wireless serial number. That way, that phone would have a phone number on your femtocell, and that way other phones on the same femtocell could call your cellphone.Unfortunately, I can't find any USB dongles that are designed for this. I searched "picocell" and "femtocell" in Google, and all I found were cellphone range extenders designed to extend the range of an already existing professionally-provided cellphone service (basically repeaters, so that if you already subscribe to a service like Sprint or Verizon you can get the signal if you happen to live in a spot not covered by their massive cellphone towers). But these are just range extenders or repeaters. They aren't true femtocell or picocell dongles. They don't create a new cellphone service, just extend the range of an already existing cellphone service.If anybody here knows if there's a good USB dongle out there that generates a cellphone service femtocell or picocell, please let me know. I've always wanted to experiment with cellphone transmissions, without having to worry that Verizon might kick me off their service for experimenting with their signal (dialing special service numbers and other things you are not supposed to do, because they might think you are trying to hack them). If I could create my own separate service not connected to any professional cellphone service providers, I could do much more experimenting with my cellphone's hidden capabilities (that are usually in hidden debug menus and stuff in the phone). Also, as I mentioned before, it could make cellphones usable like fancy walkie talkies. And furthermore, it could also allow you to provide internet service to your cellphone, if the USB picocell/femtocell dongle also bridged internet access from your computer that the dongle was plugged into.

author: Yansi
author_rank: Super Contributor
timestamp: June 15, 2019, 08:14:26 am
content: Any SDR radio that can transmit and has enough bandwidth.Just find the right software for it.

author: ogden
author_rank: Super Contributor
timestamp: June 15, 2019, 09:33:45 am
content: Quote from: Ben321 on June 15, 2019, 07:56:20 amOf course. USB is absolutely useless interface for cell network providers. Even if you would want to be as cell operator for yourself, you want Ethernet-connected femtocell, not bloody pointless USB.Quote from: Yansi on June 15, 2019, 08:14:26 amBetter take those so you can use OpenBTS as well.http://openbts.org/hardware/

author: Yansi
author_rank: Super Contributor
timestamp: June 15, 2019, 10:02:29 am
content: Very interesting! Never thought that GSM protocols vere publicly known... (i.e. making such as this is possible, without just hacking everything)

author: ejeffrey
author_rank: Super Contributor
timestamp: June 15, 2019, 05:45:21 pm
content: I don't think you will find these as prepackaged devices. I don't think part 15 had any allowance for unlicensed intentional radiators on the licensed GSM/LTE bands.Any SDR should be able to handle this. Search for "DIY stingray" to find projects that do this. Of course as I said, I think it is illegal and also impersonating a cell tower such that random people connect is also potentially fraud/hacking.As I understand it, 3G and later have encrypted authentication between the SIM and the tower. So even if you set up a tower your phone won't connect unless you have the correct signatures. Stingray worked by forcing downgrade to older protocols. So you will need to either restrict yourself to older protocols (should be fine for your application) or create your own SIM as well if that is possible.

author: Ben321
author_rank: Frequent Contributor
timestamp: June 15, 2019, 08:21:50 pm
content: Quote from: Yansi on June 15, 2019, 10:02:29 amGSM and CDMA2000 are competing standards, but they are publicly available. They are not proprietary to specific companies (trade secrets). Though individual companies probably offer non-standard extensions to those standards to provide additional features (maybe like increased security or something) that the companies want to provide. The standards themselves are like ISO or ITU standards, and are documents that you need to pay to get a copy of, but they are publicly available. It's not like Sprint or Verizon owns them.

author: Ben321
author_rank: Frequent Contributor
timestamp: June 15, 2019, 08:44:36 pm
content: Quote from: ejeffrey on June 15, 2019, 05:45:21 pmJust use an unlocked phone. Most international GSM phones are unlocked I think. Also, I think GSM is a 2G protocol, but I could be wrong. And international GSM phones are not locked to working on a specific cellphone service provider. Also, Stingray didn't actually transmit. It was a receive only device, which is only useful for interception, not for setting up a cellular femtocell. And there are ways of making it so you don't force a cellphone to connect to your base station. You can make it so that your base station doesn't accept any phone that's not in its whitelist.Cellphones look for available towers. These towers are constantly transmitting so cellphones can find them. The tower with the strongest signal is the one that the phone tries to communicate with. When the phone first detects the tower (based on that tower's transmitted ID, which is part of the tower's continuous transmission) the phone sends a ping with the tower's ID and the phone's ID every minute or so. Every phone is manufactured with a unique ID, or contains a SIM card with a unique ID (each SIM card has its own unique ID, unless it has been illegally cloned). When the tower receives this a with its ID, it checks the cellphone's ID (which is transmitted in the ping signal along with the tower ID). If the cellphone's ID is recognized, it sends a reply to the phone acknowledging the phone, and from that moment on, the tower and phone are connected.Now with setting up your own femtocell, your basestation should have software controlling it, that does not automatically accept a phone, but instead adds that phone's ID to a list displayed on the PC that the femtocell dongle is connected to. Otherwise disasterous situations could occur. A person walking by your house could connect to your femtocell, and lose connection to their sellphone service provider, which would effectively turn your femtocell into a signal jammer, and that would be ILLEGAL. So the software controlling your femtocell dongle, would prevent that by not automatically connecting with a phone. And the list of available phones would let you then select your own cellphone's ID and add it to the whitelist. Once it was whitelisted, whenever your phone was close enough that your femtocell's signal was the strongest signal, your phone would automatically connect to your femtocell. How do you know which ID in the list is your phone, so you can add the correct one? Well, seeing your phone's ID is something that should be accessible in the settings menu on your phone (possibly in a hidden/service menu, but you can go online and see how to access these special menus for your phone).

author: Ben321
author_rank: Frequent Contributor
timestamp: June 15, 2019, 08:50:30 pm
content: Quote from: ogden on June 15, 2019, 09:33:45 amActually the USB would be only for control from the host computer, adding or removing a cellphone from the connection whitelist (driver and software installed on the PC), so that not every phone within 50 feet automatically connected to your femtocell. The actual signal processing would be done in the dongle itself, via a microcontroller. Transmission and reception would be done via 2 custom-build radio chips (one for transmission, and one for reception) and an ADC and a DAC. The ADC and DAC would communicate directly with the microcontroller. In other words, it would be a computer controlled transceiver, not a true SDR. None of the signal processing would be done on the PC, so the speed of the USB connection would not be too slow.

author: ogden
author_rank: Super Contributor
timestamp: June 15, 2019, 09:29:06 pm
content: Quote from: Ben321 on June 15, 2019, 08:50:30 pmWhat good are your dreams about USB femtocell dongle if it does not exist and never will?

author: TheSteve
author_rank: Unknown
timestamp: June 16, 2019, 12:22:27 am
content: Even if you were to get a USB dongle and it was low enough power it still wouldn't be legal. And the phone transmitting to it wouldn't be either.Years ago there were analog cell basestation units designed to be portable - I always wanted one as they were capable of being plugged into regular phone lines and used.There was a Motorola cordless/cellphone that existed too. It functioned as a cordless phone and as a cellular phone. The included base station used very low power analog cell frequencies to communicate with the phone. It had to be provisioned by the cellular provider which coordinated legal frequency use. The phone was also special in that it had a super lower transmit power mode.

author: ogden
author_rank: Super Contributor
timestamp: June 16, 2019, 12:48:59 am
content: Quote from: TheSteve on June 16, 2019, 12:22:27 amToday it is Ethernet-enabled femtocell. Thou seems like operators are discontinuing femtocell offers for home users.https://www.repeaterstore.com/pages/femtocell-and-microcell

author: Lord of nothing
author_rank: Super Contributor
timestamp: June 19, 2019, 10:19:10 am
content: The major Problem is there is no Band where a Cellphone Service could run nowerdays.All Bands are in Use for GSM, 3G, LTE or the upcoming "5G".And on the other Side i dont see any normal commercial Phone who can add an new Band.Huawei offer a "Private" LTE Soloution. The major Problem will be finde a Band who nohting runs on.https://e.huawei.com/en/products/wireless/elte-trunking

author: 9aplus
author_rank: Regular Contributor
timestamp: June 19, 2019, 03:12:55 pm
content: LimeSDR USB can run that service over USB3Browse for examples here ->https://discourse.myriadrf.org/I managed to run OsmoBTS stack on Ubuntu 16.04 2 years ago,running low power / no interference to regular services.GSM and TXT messages was possible. There are also peoplerunning G5 tests on the same HWOther story is how you can make such service legal...

author: Ben321
author_rank: Frequent Contributor
timestamp: July 03, 2019, 02:41:53 am
content: Quote from: Lord of nothing on June 19, 2019, 10:19:10 amActually there is. Any existing band that is (or was) used for cell service, means either current cellphones (or older ones I can get on eBay) will attempt to communicate via a given band. They will scan all the valid frequencies in that band looking for a tower's signal. If you transmit on a valid frequency for the given type of cell service you are trying to provide, and make sure that frequency is not already in use for something else, then a cellphone that uses the type of service you are trying to provide, will be able to lock onto you signal. Just make sure you don't transmit at a power level that can interfere with other phones operating on that (or another) cellphone service provided by an actual commercial cellphone service provider. Limiting the output power so that your phone can't find the signal beyond about 10 feet away, should prevent any unintentional interference.

author: Ben321
author_rank: Frequent Contributor
timestamp: July 03, 2019, 02:43:34 am
content: Quote from: 9aplus on June 19, 2019, 03:12:55 pmSounds very interesting. Problem is one word you used there "Ubuntu". That's a version of Linux. I'm using Windows. Can LimeSDR work on a Windows computer? Are there Windows drivers for it? How about the software that implements a cellphone tower's protocol? Is that software available for Windows?

author: NiHaoMike
author_rank: Super Contributor
timestamp: July 03, 2019, 03:04:09 pm
content: Couldn't you use the ISM band (900MHz where cell service is 850MHz and vice versa) in order to avoid interference to/from commercial cell networks? In any case, it's still a solution looking for a problem. What are you looking to do that Wifi can't?

author: dmills
author_rank: Super Contributor
timestamp: July 03, 2019, 04:04:14 pm
content: The chaos computer club events generally have their own in house GSM network run by agreement with one of the spectrum owners.It works, at the scale of a few thousand handsets, but the smart money uses the DECT network they also run at those events, lower latency, and usually better quality.IIRC, there was a phone (Motorola?) where the security around the RF interface had been broken and by modifying the RF filters and interfacing it to a PC you could get it to act as a BASE station.Regards, Dan.

author: donmr
author_rank: Regular Contributor
timestamp: July 03, 2019, 04:43:19 pm
content: AT&T calls them "Microcells". They use a Cisico DPH-154 device which is connected by ethernet to their servers.

author: Gribo
author_rank: Frequent Contributor
timestamp: July 03, 2019, 05:39:31 pm
content: There were old Alcatel GSM phones which could act as a base station, with some trivial FW mod.

author: Lord of nothing
author_rank: Super Contributor
timestamp: July 04, 2019, 08:18:06 am
content: There was a Hack with some old noika phoes but i dont know if the run as bs.Quotenot anymore! The was running on a back then abandoned band who is now used for some service.Nower Days the use a DECT System.http://openbts.org/hardware/

author: 9aplus
author_rank: Regular Contributor
timestamp: July 07, 2019, 02:00:58 pm
content: @Ben321Yes it is Linux derivationLimeSDR work on Win, drivers are available,personally I am running LimeSDR on Win 10, Ubuntu and RPI RaspibianSo far I am not aware of any open implementation of cell SW infrastructure running on Win

author: Ben321
author_rank: Frequent Contributor
timestamp: August 19, 2019, 11:53:38 pm
content: Quote from: 9aplus on July 07, 2019, 02:00:58 pmI've heard it can be implemented directly in the LimeSDR firmware itself, uploaded via a firmware flasher software that you can download for Windows (I forget what it's called now). USB then only powers the device, and the LimeSDR then runs as a standalone cell tower, providing free service to all phones in range. All phones linked to the tower can call each other, but no access to the normal phone system (no cell phones connected to a normal tower, and no landline phones). Depending on firmware you choose to upload it can be a cell tower for GSM, CDMA, LTE, UMTS, etc.Alternatively, it looks like this also lets you setup your own personal cellphone pico/femto cell, ad works for every cellphone protocol except CDMA and UMTS.https://yatebts.com/products/lte_lab_kit/Unfortunately it costs over $5000. It's intended for manufacturers of cellphones to test their cellphones in a lab.Here's a cheaper version of the above product, and works only with GSM/GPRS protocols.https://yatebts.com/products/lab_kit/