 | |
| Stable release | 4.0 / March 26, 2014; 10 years ago (2014-03-26) |
|---|---|
| Repository | |
| Written in | C++ |
| Operating system | Unix-like |
| Type | GSM protocol stack |
| License | GNU Affero General Public License[1] |
| Website | OpenBTS |
OpenBTS (Open Base Transceiver Station) is a software-basedGSM access point, allowing standard GSM-compatiblemobile phones to be used asSIP endpoints inVoice over IP (VoIP) networks. OpenBTS is open-source software developed and maintained byRange Networks. The public release of OpenBTS is notable for being the firstfree-software implementation of the lower three layers of the industry-standard GSMprotocol stack.It is written inC++ and released as free software under the terms of version 3 of theGNU Affero General Public License.
OpenBTS replaces the conventional GSM operatorcore network infrastructure from layer 3 upwards. Instead of relying on externalbase station controllers forradio resource management, OpenBTS units perform this function internally. Instead of forwarding call traffic through to an operator'smobile switching center, OpenBTS delivers calls viaSIP to a VOIP soft switch (such asFreeSWITCH oryate) orPBX (such asAsterisk). This VOIP switch or PBX software can be installed on the same computer used to run OpenBTS itself, forming a self-contained cellular network in a single computer system. Multiple OpenBTS units can also share a common VOIP switch or PBX to form larger networks[2]
The OpenBTSUm air interface uses asoftware-defined radiotransceiver with no specialized GSM hardware. The original implementation used aUniversal Software Radio Peripheral from Ettus Research, but has since been expanded to support several digital radios in implementations ranging from full-scale base stations to embeddedfemtocells.
The project was started by Harvind Samra and David A. Burgess[3] with the aim of the project to drastically reduce the cost of GSM service provision in rural areas, the developing world, and hard to reach locations such as oil rigs.[4] The project was initially conducted through Kestrel Signal Processing, the founders' consulting firm.
On September 14, 2010, at the Fall 2010DEMO conference, the original authors launchedRange Networks as a start up company to commercialize OpenBTS-based products.[5]
In September 2013, Burgess left Range Networks and started a new venture called Legba[6] and started a close collaboration with Null Team SRL, the developers ofYate. In February 2014, Legba and Null announced the release of YateBTS, a fork of the OpenBTS project that uses Yate for its control layers and network interfaces.
A large number of experimental installations have shown that OpenBTS can run on extremely low overhead platforms. These including some CDMA handsets - making a GSM gateway to aCDMA network. Computer security researcher Chris Paget reported[7] that a handheld device, such as anAndroid phone, could act as a gateway base station to which handsets can connect; the Android device then connects calls using an on-boardAsterisk server and routes them to thePSTN viaSIP over an existing3G network.
At the 2010DEF CON conference, it was demonstrated with OpenBTS that GSM calls can be intercepted because in GSM the handset does not authenticate the base station prior to accessing the network.[8]
OpenBTS has been used by the security research community to mount attacks on cellular phone baseband processors.[9][10] Previously, investigating and conducting such attacks was considered impractical due to the high cost of traditional cellular base station equipment.
Large scale live tests of OpenBTS have been conducted in the United States in Nevada and northern California using temporary radio licenses applied for through Kestrel Signal Processing andRange Networks, Inc.
During theBurning Man festival in August 2008, a week-long live field test was run underspecial temporary authorization license.[11][12] Although this test had not been intended to be open to Burning Man attendees in general, a number of individuals in the vicinity succeeded in making out-going calls after a mis-configured Asterisk PBX installation allowed through test calls prefixed with aninternational code.[13] The test connected about 120 phone calls to 95 numbers in area codes over North America.
At the 2009 Burning Man festival, a larger test setup was run using a 3-sector system.[14] For the 2010 festival, an even larger 2-sector 3-carrier system was tested.
At the 2011 festival, the OpenBTS project set up a 3-site network withVSAT gateway and worked in conjunction with theVoice over IP services companyVoxeo to provide much of the off-site call routing.[15][16]
RELIEF is a series of disaster response exercises managed by theNaval Postgraduate School inCalifornia, USA.[17] Range Networks operated OpenBTS test networks at the RELIEF exercises in November 2011[18] and February 2012.[19]
In 2010, an OpenBTS system was installed on the island ofNiue and became the first installation to be connected and tested by a telecommunication company. Niue is a very small island country with a population of about 1,700 - too small to attract mobile telecommunications providers. The cost structure of OpenBTS suited Niue, which required a mobile phone service but did not have the volume of potential customers to justify buying and supporting a conventional GSM basestation system.[20]
The success of this installation and the demonstrated demand for service helped bootstrap later commercial services. The OpenBTS installation was later decommissioned ~February 2011 by Niue Telecom, a commercial grade GSM 900 network with Edge support was instead launched few months later (3x sites in Kaimiti O2, Sekena S2/2/2 and Avatele S2/2/2) this provided full coverage around the island and around the reef, the installation included a pre-pay system, USSD, Int. SMS and new Int. Gateway.
From July 26 to July 29, 2012, the Ninja Networks team set up a "NinjaTel Van" in the Vendor[21] area of Defcon 20 (at the Rio Hotel/Casino in Las Vegas.) It used OpenBTS and served a small network of 650GSM phones with custom SIM cards.[22]
