Passive electronic fence for 4G mobile communication network

Abstract

The invention discloses a passive electronic fence aiming at a 4G mobile communication network, which utilizes a communication reconnection process of a mobile phone from an idle state to a service state, monitors random access initiated by the mobile phone in a base station in a passive mode on the basis of acquiring base station information, and utilizes monitored and analyzed message content to monitor random access of the mobile phone in the base station. According to the method, resources used in a random access process are calculated, and a cell network temporary identifier (C-RNTI) for communication between a base station and a mobile phone is obtained, so that time-frequency resources, a PDCCH (Physical Downlink Control Channel) and a PUSCH (Physical Uplink Shared Channel) used by interaction between the base station and the mobile phone are continuously tracked and monitored, identity response signaling reported by the mobile phone in an RRC link establishment process can be analyzed, and IMSI (International Mobile Subscriber Identity) identification information of the mobile phone can be analyzed from the identity response signaling. Through the above mode, the method does not need transmitting power, is not influenced by factors such as base station signal strength and neighbor cell configuration information, does not influence public network communication signal quality, and passively realizes terminal IMSI acquisition.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a passive electronic fence for a 4G mobile communication network. Background Art

[0002] Electronic fence technology is a technology that monitors the activities of people in an area by monitoring mobile communication devices. When people carrying mobile communication devices enter the controlled area, the International Mobile Subscriber Identity (IMSI) can be collected immediately, and the relevant data will be automatically transmitted to the background server system platform for statistics and storage. This technology integrates the information collected daily through multi-dimensional data fusion to improve the value of the data. In situations where face recognition and image acquisition technologies cannot play a role, electronic fence technology can greatly broaden the data collection channels, explore the correlation between implicit interconnected perception data, and improve the quantity and quality of data collection.

[0003] At present, the electronic fences on the market are usually active, using high power to attract mobile communication terminals, using the principle of pseudo base stations to simulate operator base stations, and luring users to the network deployed by pseudo base stations to obtain IMSI. There are the following defects: Disadvantage 1: Active electronic fences emit high-power signals, which interfere with the public network base station signals, affecting the quality of public network signals, reducing the Internet speed of detected users, or even making them unable to access the Internet; Disadvantage 2: High power consumption, requiring high power to attract terminals, and the monitoring range is affected by the operator's signal field strength. When the operator's signal is very strong, the monitoring range will not meet the usage requirements; Disadvantage 3: Active electronic fences use the principle of pseudo base stations. The PCI configured on the device needs to form a neighboring area relationship with the public network base station to realize user detection. In the 4G network, the neighboring area relationship is no longer broadcast on the air interface, and the spatial signal propagation is complex. The device cannot determine that the communication network with each terminal constitutes a neighboring area, and users may be missed from detection.

[0004] Based on the above defects and shortcomings, it is necessary to improve the existing technology and design a passive electronic fence for 4G mobile communication network. Summary of the invention

[0005] The main technical problem solved by the present invention is to provide a passive electronic fence for 4G mobile communication network, which does not require transmission power, is not affected by factors such as base station signal strength, neighboring area configuration information, does not affect the quality of public network communication signals, and passively realizes terminal IMSI acquisition.

[0006] In order to solve the above technical problems, a technical solution adopted by the present invention is: to provide a passive electronic fence for a 4G mobile communication network, comprising the following steps:

[0007] S1. Analyze the public base station signal at one or more set frequencies to obtain the physical cell identifier PCI (Physical Cell Identifier) ​​of the public base station, the frame header position of the communication frame and the system information block SIB (System Information Block). The SIB contains the physical channel PRACH (Physical Random Access Channel) configuration of the mobile phone.

[0008] S2. According to the PRACH channel configuration, the specified time-frequency resource position is monitored, the random access signal sent by the mobile phone is monitored and the random access preamble code RAPID (Random Access Preamble Identifier) ​​is obtained. According to the time-frequency resource position and RAPID code used by the mobile phone to transmit PRACH, the random access network temporary identifier RA-RNTI (Random Access-RNTI) for random access by the mobile phone can be calculated. The RA-RNTI value is used as the identifier of the base station response to the random access of the mobile phone;

[0009] S3, monitor the physical downlink control channel PDCCH (Physical Downlink Control Channel) of the base station, use RA-RNTI to perform cyclic redundancy check CRC (Cyclic Redundancy Check) on the PDCCH channel, and if the check is successful, the time advance TA (Timing advance) of the mobile phone's uplink signal, the temporary cell network temporary identifier TC-RNTI (Temporary-Cell RNTI) of the mobile phone at the base station, and the time-frequency resource position of the mobile phone's next physical uplink shared channel PUSCH (Physical Uplink Shared Channel) information; after another random access contention resolution process, the mobile phone can establish a radio resource control RRC (Radio Resource Control) connection with the base station, and the cell network temporary identifier C-RNTI (Cell-Radio Network Temporary Identity) will replace the temporary cell network temporary identifier TC-RNTI as the unique identifier for subsequent communication between the base station and the mobile phone;

[0010] S4. Continue to monitor the downlink PDCCH channel of the base station, and use C-RNTI to perform CRC check on the PDCCH channel. If the check is successful, determine whether the downlink control information DCI (Downlink Control Information) is in format 1-A. This message contains the time-frequency resources and modulation coding mode of the mobile phone's uplink PUSCH channel. Monitor and parse the PUSCH message at the obtained PUSCH channel time-frequency resource position, obtain the communication signaling reported by the mobile phone, and compare it with the type code of the Identify_response signaling. After determining that it is the Identify_response signaling, extract the IMSI value.

[0011] Preferably, the mobile terminal will release the wireless link and enter the idle state when the service is idle. When data communication is carried out again, the random access and link establishment request will be re-initiated. During this process, the mobile terminal will report the identity information in the non-access layer NAS (NonAccess Stratum) layer signaling. The passive electronic fence uses this process to detect and analyze the identity information of the mobile terminal.

[0012] Preferably, in order to realize the parsing of non-access stratum NAS layer signaling for communication between mobile phones and public network base stations, it is necessary to obtain the C-RNTI agreed upon by the mobile phone and the base station during the random access process of the mobile phone. The passive electronic fence always monitors the time-frequency resource location and process of random access, parsing from RA-RNTI to TC-RNTI, and then to C-RNTI.

[0013] Preferably, the PDCCH channel sent by the base station is monitored according to the acquired cell information, synchronization header and C-RNTI, and the DCI message of format 1-A is obtained, so as to obtain the time-frequency resource location and demodulation parameters of the PUSCH channel, further monitor and parse the PUSCH information, and obtain the IMSI information in the identify_response signaling.

[0014] Compared with the prior art, the present invention has the following beneficial effects:

[0015] It does not attract mobile phones by impersonating commercial base stations and transmitting high-power signals; this solution does not require transmission power, but obtains the identity information of the mobile phone by monitoring and parsing the NAS layer signaling in the communication establishment between the mobile phone and the public network base station; each resource of the passive electronic fence monitors one base station, and multiple base stations can be monitored simultaneously through multiple resources. As long as the resources are sufficient, all base stations in the target area can be monitored. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A schematic diagram of a passive electronic fence process for a 4G mobile communication network;

[0017] Figure 2 Base station signal time-frequency resource monitoring diagram;

[0018] Figure 3 This is a PUSCH channel monitoring analysis diagram. DETAILED DESCRIPTION

[0019] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings so that the advantages and features of the invention can be more easily understood by those skilled in the art, thereby making a clearer and more definite definition of the protection scope of the present invention.

[0020] See also Figures 1 to 3 , the embodiment of the present invention includes:

[0021] A passive electronic fence for a 4G mobile communication network comprises the following steps:

[0022] S1. System initialization, determination of analysis frequency: Initialization of electronic fence equipment, configuration of equipment frequency, monitoring of one base station per resource, or simultaneous monitoring of multiple base stations through multiple resources, analysis of 10ms data for base station communication frequency, filtering and downsampling to 6 resource blocks RB (Resource Block);

[0023] S2, carrier frequency offset correction, downlink synchronization: remove the signal DC subcarrier, perform downlink synchronization on the signal, estimate the carrier frequency offset, perform carrier frequency offset correction on the signal, and obtain the physical cell identifier PCI (Physical Cell Identifier) ​​and frame header position through downlink synchronization signal search synchronization. The downlink synchronization signal search includes the primary synchronization signal PSS (Primary Synchronization Signal) search and the secondary synchronization signal SSS (Secondary Synchronization Signal);

[0024] S3, obtain cell information, RACH configuration information: after completing time domain synchronization and frequency offset correction, use the physical cell identifier PCI (Physical Cell Identifier) ​​to demodulate the physical broadcast channel PBCH (Physical Broadcast Channel) from the 0th subframe and decode the broadcast channel BCH (Broadcast Channel) to obtain the main system message MIB, use the cell network temporary identifier (SI-RNTI = 65535) of the system message MIB to perform blind detection of the physical downlink control channel PDCCH (Physical Downlink Control Channel) channel to obtain the downlink control information DCI information, and demodulate the physical downlink shared channel PDSCH channel according to the obtained downlink control information DCI information to obtain the system information block SIB system message. The system information block SIB contains the random access channel RACH configuration of the mobile phone. The RACH parameters are obtained in the system information block SIB; the RACH parameters mainly include: ① the time-frequency resource position of the random access channel in the system frame, the time division duplex TDD (Time Division Duplexing) contains multiple time-frequency resource locations; ② The random access preamble RAPID (Random Access Preamble Identifier) ​​set available for random access by the mobile phone. The user's mobile phone randomly selects a RAPID from the random access preamble RAPID set to send;

[0025] S4, PRACH detection: monitor whether there is a Msg1 message for random access by a mobile phone at the random access channel frequency position specified by the RACH parameters, and parse the random access preamble RAPID (Random Access Preamble Identifier) ​​number in the Msg1 message, and calculate the random access network temporary identifier RA-RNTI (Random Access-RNTI) in combination with the time-frequency resource position of the mobile phone transmitting the physical channel PRACH. The specific calculation formula is:

[0026] RA-RNTI=1+t_id+10*f_id,

[0027] Where t_id indicates the subframe index of the physical channel PRACH of the mobile phone (0≤t_id<10), and f_id indicates the random access preamble RAPID number (0≤f_id<6);

[0028] S5. Monitor the random access process to obtain TC-RNTI: Starting from the third subframe after the subframe where Msg1 is located, and continuing for ra-ResponseWindowSize (the length of the monitoring window) subframes, the physical downlink control channel PDCCH (Physical Downlink Control Channel) channel is blindly detected, and the random access network temporary identifier RA-RNTI (Random Access-RNTI) is used to perform a cyclic redundancy check CRC (Cycli cred undancy check) check on the physical downlink control channel PDCCH channel. If the check is successful, the downlink control information DCI information is obtained. According to the downlink control information DCI information, the Msg2 information can be parsed in the physical downlink shared channel PDSCH channel, which includes the temporary cell network temporary identifier TC-RNTI (Temporary-Cell RNTI) and other information. After another random access contention resolution process, the TC-RNTI is converted to the cell network temporary identifier C-RNTI; if the physical downlink control channel PDCCH is not successfully parsed within the duration, it is deemed that the random access process has failed, and the electronic fence terminates the subsequent process of the random access;

[0029] S6. Get C-RNTI: After getting the base station physical cell identifier, frame synchronization and the cell network temporary identifier C-RNTI for communication between the base station and the mobile phone, monitor and analyze the physical downlink control channel PDCCH channel of the base station downlink and the physical uplink shared channel PUSCH channel of the mobile phone uplink;

[0030] S7, monitoring PUSCH: perform blind detection on the physical downlink control channel PDCCH channel, use the cell network temporary identifier C-RNTI to perform cyclic redundancy check CRC (Cyclic redundancy check), because we only need to obtain the Identify_response signaling of the mobile phone uplink, after the cyclic redundancy check CRC verification is successful, determine whether the downlink control information DCI is format 1-A (this format contains the scheduling information UL-Grant of the uplink physical uplink shared channel PUSCH channel, parse the downlink control information DCI information in this format, the scheduling information UL-Grant contains the Fixed size resource block assignment, modulation and coding parameters MCS (Modulation and Coding Scheme), transmission power control TPC (Transmit Power Control) and other information, Fixed size resource block assignment indicates the time-frequency position of the physical uplink shared channel PUSCH, the parameter is used to indicate the modulation mode of the physical uplink shared channel PUSCH; Transmit power control TPC (Transmit Power Control) is used to set the power of the physical uplink shared channel PUSCH;

[0031] S8. Obtain Identify_response signaling and obtain IMSI: parse the physical uplink shared channel PUSCH channel according to the time-frequency resource position obtained in the scheduling information UL-Grant, perform SC-OFDM (Single Carrier Orthogonal Frequency Division Multiplexing) demodulation on the physical uplink shared channel PUSCH channel, parse the time domain signal into time-frequency resource blocks RE, and then perform constellation mapping according to the parameters, demap the frequency resource block RE information of the physical uplink shared channel PUSCH channel into a bit sequence, and perform descrambling operation on the demapped sequence. The descrambling sequence is based on the physical cell identifier, subframe number and cell network temporary identifier C-RNTI. The descrambling sequence C init The generation formula is as follows:

[0032]

[0033] in Indicates the physical cell identifier of the base station, n s represents the subframe number of the current communication, and q represents the codeword number of the descrambling sequence;

[0034] The descrambled sequence is Turbo channel decoded according to the modulation and coding parameter MCS (Modulation and Coding Scheme) coding parameters, and the bit sequence obtained after channel decoding is compared with the structure of the Identify_reponse signaling to determine whether it is the Identify_response signaling type. If it is indeed of this type, the International Mobile Subscriber Identity IMSI value is extracted to obtain the mobile phone identity information.

[0035] The passive electronic fence for 4G mobile communication network of the present invention comprises the following two parts: one is to parse the synchronization header and system message MIB of the base station signal and monitor and parse the random access process between the base station and the mobile phone, and obtain the cell network temporary identification C-RNTI for communication between the base station and the mobile phone; the second is to parse the physical downlink control channel PDCCH channel sent by the base station according to the obtained cell information, synchronization header and cell network temporary identification C-RNTI, and obtain the time-frequency resource position and demodulation parameters of the physical uplink shared channel PUSCH channel, so as to realize the monitoring and parsing of the communication signaling reported by the mobile phone, and obtain the international mobile user identity code IMSI information in the identify_response signaling.

[0036] The invention discloses a passive electronic fence for 4G mobile communication network. It does not attract mobile phones by posing as commercial base stations and transmitting high-power signals, and does not require transmitting power. Instead, it obtains the identity information of the mobile phone by monitoring and parsing the non-access layer NAS (NonAccess Stratum) layer signaling in the communication establishment between the mobile phone and the public network base station. The mobile phone terminal will release the wireless link and enter the idle state when the service is idle. When data communication is performed again, the random access and link establishment request will be re-initiated. During the process, the mobile phone terminal will report the identity information in the NAS layer signaling. The passive electronic fence uses this process to monitor and parse the identity information of the mobile phone terminal. The passive electronic fence needs to realize the parsing of the NAS layer signaling of the communication between the mobile phone and the public network base station, and needs to obtain the cell network temporary identification C-RNTI agreed between the mobile phone and the base station in advance during the random access process of the mobile phone.

[0037] Passive electronic fences can monitor and analyze the PDCCH channel of the base station based on the C-RNTI, base station physical cell identifier and frame synchronization obtained during the random access process, perform blind decoding of the PDCCH channel, and use C-RNTI for CRC check. If the check is successful, it determines whether the DCI is format 1-A, and obtains the time-frequency resources and coding mode (MCS) of the PUSCH channel through DCI format 1-A, thereby determining the time-frequency resource location of the mobile phone's PUSCH channel; then monitor and analyze the PUSCH information at the obtained PUSCH channel time-frequency resource location, obtain the communication signaling reported by the mobile phone, and compare it with the type code of the Identify_response signaling, lock the Identify_response signaling, and extract the IMSI value.

[0038] The invention discloses a passive electronic fence for 4G mobile communication network. Compared with the traditional active electronic fence, it does not need transmission power, is not affected by factors such as base station signal strength and neighboring cell configuration information, does not affect the quality of public network communication signals, and passively realizes terminal IMSI acquisition.

[0039] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A passive electronic fence for 4G mobile communication network, characterized by: The following steps are involved: S1. Analyze the public base station signal at one or more set frequencies to obtain the physical cell identifier PCI (Physical Cell Identifier) ​​of the public base station, the frame header position of the communication frame and the system information block SIB (System Information Block). The SIB contains the physical channel PRACH (Physical Random Access Channel) configuration of the mobile phone. S2. According to the PRACH channel configuration, the specified time-frequency resource position is monitored, the random access signal sent by the mobile phone is monitored and the random access preamble code RAPID (Random Access Preamble Identifier) ​​is obtained. According to the time-frequency resource position and RAPID code used by the mobile phone to transmit PRACH, the random access network temporary identifier RA-RNTI (Random Access-RNTI) for random access by the mobile phone can be calculated. The RA-RNTI value is used as the identifier of the base station response to the random access of the mobile phone; S3, monitor the physical downlink control channel PDCCH (Physical Downlink Control Channel) of the base station, use RA-RNTI to perform cyclic redundancy check CRC (Cyclic Redundancy Check) on the PDCCH channel, and if the check is successful, the time advance TA (Timing advance) of the mobile phone's uplink signal, the temporary cell network temporary identifier TC-RNTI (Temporary-Cell RNTI) of the mobile phone at the base station, and the time-frequency resource position of the mobile phone's next physical uplink shared channel PUSCH (Physical Uplink Shared Channel) information; after another random access contention resolution process, the mobile phone can establish a radio resource control RRC (Radio Resource Control) connection with the base station, and the cell network temporary identifier C-RNTI (Cell-Radio Network Temporary Identity) will replace the temporary cell network temporary identifier TC-RNTI as the unique identifier for subsequent communication between the base station and the mobile phone; S4. Continue to monitor the downlink PDCCH channel of the base station, and use C-RNTI to perform CRC check on the PDCCH channel. If the check is successful, determine whether the downlink control information DCI (Downlink Control Information) is in format 1-A. This message contains the time-frequency resources and modulation coding mode of the mobile phone's uplink PUSCH channel. Monitor and parse the PUSCH message at the obtained PUSCH channel time-frequency resource position, obtain the communication signaling reported by the mobile phone, and compare it with the type code of the Identify_response signaling. After determining that it is the Identify_response signaling, extract the IMSI value.

2. A passive electronic fence for 4G mobile communication network according to claim 1, characterized in that: When the mobile terminal is in an idle state, it will release the wireless link and enter the idle state. When it starts data communication again, it will re-initiate random access and link establishment requests. During this process, the mobile terminal will report its identity information in the non-access layer NAS (NonAccess Stratum) layer signaling. The passive electronic fence uses this process to detect and analyze the identity information of the mobile terminal.

3. A passive electronic fence for 4G mobile communication network according to claim 1, characterized in that: To implement the parsing of non-access stratum (NAS) layer signaling between mobile phones and public network base stations, it is necessary to obtain the C-RNTI agreed upon by the mobile phone and the base station during the random access process of the mobile phone. The passive electronic fence monitors the time-frequency resource location and process of random access, parsing from RA-RNTI to TC-RNTI, and then to C-RNTI.

4. A passive electronic fence for 4G mobile communication network according to claim 1, characterized in that: According to the acquired cell information, synchronization header and C-RNTI, the PDCCH channel sent by the base station is monitored, and the DCI message of format 1-A is obtained, so as to obtain the time-frequency resource location and demodulation parameters of the PUSCH channel, further monitor and parse the PUSCH information, and obtain the IMSI information in the identify_response signaling.

Images