The FAQ have been moved here.


Research in GSM from the operator point of view requires access to a network. Since access to a GSM network is restricted to the operator, we had to set up our own network. Based on open source software openBSC, LCR and Asterisk, we were able to develop and set up a GSM-Network at two locations within the University of Freiburg.

The RZ-GSM network is a GSM research network without any service guarantee. Access to the network is restricted to the members of the university. It is maintained by the Chair of Communication Systems.

Projects based on RZ-GSM

Using the RZ-GSM network, different research topics are currently being investigated.

  • Positioning of Mobile Stations via Measurement Reports.
    During an active connection (e.g. call, location update, or sms), measurement reports (MR) are sent from the mobile station (MS) to the network. These MR contain the received signal strength of neighbor cells. In normal operation they are used for handover. The aim is to evaluate whether a statement on the position of the MS can be made and what degree of precision can be expected. Further it will be evaluated if the MR generated during location update can be seen as a positioning of the MS.
  • Location Based Services (LBS)
    We would like to offer location-based services based on the position of a subscriber. Therefore the position of a subscriber must be known. Depending on the precision of the information on the subscriber's position, different LBS are possible. For example, knowing the rough position of the subscriber (Is he at the faculty or at the computing center?), he could be provided with information about the meals at the canteen.
  • Statistics about user behavior within the network
    During normal operation of the network a lot of information is generated. Some of this information can be used to generate user profiles containing the behavior of the user. It is being investigated what information is accumulated during normal operation. As well, possibilities for the protection of the user's privacy are being investigated.
  • GSM Security
    Since GSM is the most used mobile network worldwide, security is an important issue. This includes:
  • reliability of the encryption standard A5/1, which is not secure anymore.
  • attacks on the network and subscribers.

Please note that we do not attack any subscriber on the network without previous notification.

Structure of the RZ-GSM network

(graphic large: network_structure_public.png):

Basestation (BTS)

We are using nanoBTS from ip.access. These are small basestations the size of a laptop. The normal power output is 200 mWatts. To increase the coverage of the basestation we use a nanoBTS GSM booster from PROXIMUS. Thus the output power is increased to 2 Watts. To operate the basestation a license is required. We have a license for 3 different GSM channels, all located in the DCS 1800 frequency band. The channel numbers are: 871, 877, and 880.

Basestation Controller (BSC)

The basestation controller is the main unit of our network. From here we control and configure the network. We are using the open source software openBSC in combination with LCR. LCR is used as a gateway to our telephony network and is connected to an asterisk telephony system.


This is our main telephony system. Here all calls are forwarded to the right destination network. Depending on the target network, the system chooses different connections to forward the call. The following outgoing channels are available:
  • German land line telephony network: 3 channels
  • Mobile telephony networks: Vodafone, T-Mobile, O2, E-Plus: 1 channel per provider
  • University internal telephones: 2 channels

For incoming connections we have two ISDN channels connected to the university telephony system.

network_structure_public.png (100.4 kB) konrad, 09/06/2011 06:25 pm

network_structure_public_small.png (70.1 kB) konrad, 09/06/2011 06:25 pm