summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTom2012-06-11 01:30:01 +0200
committerTom2012-06-11 01:30:01 +0200
commitc8e58a4c5a5d2c899ae2ede5612e18f8965c5452 (patch)
treeaf36c1680eebbef445f028a10823a6afd240c630
parentremoved url (diff)
downloadimsi-catcher-detection-c8e58a4c5a5d2c899ae2ede5612e18f8965c5452.tar.gz
imsi-catcher-detection-c8e58a4c5a5d2c899ae2ede5612e18f8965c5452.tar.xz
imsi-catcher-detection-c8e58a4c5a5d2c899ae2ede5612e18f8965c5452.zip
more shininess
-rw-r--r--Src/PyCatcher/GUI/catcher_main.glade3
-rw-r--r--Src/PyCatcher/src/pyCatcherController.py2
-rw-r--r--Tex/Content/Abstract.tex16
-rw-r--r--Tex/Content/Acknowledgements.tex6
-rw-r--r--Tex/Content/Appendix.tex2
-rw-r--r--Tex/Content/Conclusion.tex11
-rw-r--r--Tex/Content/GSM_short.tex305
-rw-r--r--Tex/Content/Motivation.tex59
-rw-r--r--Tex/Master/Glossary.tex4
-rw-r--r--Tex/Master/Master.acn185
-rw-r--r--Tex/Master/Master.aux19
-rw-r--r--Tex/Master/Master.bbl6
-rw-r--r--Tex/Master/Master.blg61
-rw-r--r--Tex/Master/Master.ist2
-rw-r--r--Tex/Master/Master.log685
-rw-r--r--Tex/Master/Master.lot2
-rw-r--r--Tex/Master/Master.pdfbin20274633 -> 20433743 bytes
-rw-r--r--Tex/Master/Master.tex3
-rw-r--r--Tex/Master/Master.toc7
19 files changed, 969 insertions, 409 deletions
diff --git a/Src/PyCatcher/GUI/catcher_main.glade b/Src/PyCatcher/GUI/catcher_main.glade
index 43747c9..63342bd 100644
--- a/Src/PyCatcher/GUI/catcher_main.glade
+++ b/Src/PyCatcher/GUI/catcher_main.glade
@@ -1466,12 +1466,13 @@ Configuration/Context Rules
</child>
<child>
<object class="GtkCheckButton" id="cb_neighbours_discovered">
- <property name="label" translatable="yes">Fully discovered Neighbourhoods</property>
+ <property name="label" translatable="yes">Discovered Neighbourhoods</property>
<property name="visible">True</property>
<property name="can_focus">True</property>
<property name="receives_default">False</property>
<property name="use_action_appearance">False</property>
<property name="xalign">0</property>
+ <property name="active">True</property>
<property name="draw_indicator">True</property>
</object>
<packing>
diff --git a/Src/PyCatcher/src/pyCatcherController.py b/Src/PyCatcher/src/pyCatcherController.py
index 1ab2a70..e20841f 100644
--- a/Src/PyCatcher/src/pyCatcherController.py
+++ b/Src/PyCatcher/src/pyCatcherController.py
@@ -58,7 +58,7 @@ class PyCatcherController:
self.pure_neighbourhood_rule = PureNeighbourhoodRule()
self.pure_neighbourhood_rule.is_active = True
self.full_discovered_neighbourhoods_rule = DiscoveredNeighboursRule()
- self.full_discovered_neighbourhoods_rule.is_active = False
+ self.full_discovered_neighbourhoods_rule.is_active = True
self.cell_id_db_rule = CellIDDatabaseRule()
self.cell_id_db_rule.is_active = False
self.location_area_database_rule = LocationAreaDatabaseRule()
diff --git a/Tex/Content/Abstract.tex b/Tex/Content/Abstract.tex
index c5e548c..d319e54 100644
--- a/Tex/Content/Abstract.tex
+++ b/Tex/Content/Abstract.tex
@@ -4,18 +4,18 @@
\end{center}
For several years now security flaws in the GSM protocol have been known and exploited.
A device called IMSI catcher, first developed in 1996, uses some of these flaws to enable the operator to localise a mobile subscriber and tap into phone calls.
-Since only authorities were able to obtain these devices the risk for abuse was deemed minor at first.
-However due to the progress in freely available GSM related software and hardware, like OpenBTS and the Universal Software Radio Peripheral, it is now possible for anyone to build an inexpensive version of an IMSI catcher.
+Since only authorities were able to obtain these devices, the risk for abuse was deemed minor at first.
+However, due to the progress in freely available GSM related software and hardware, like OpenBTS and the Universal Software Radio Peripheral, it is now possible for anyone to build an inexpensive version of an IMSI catcher.
Although operation is prohibited by law, the possibility of affordable self-construction increases the risk of abuse in the private sector and in relation with industrial espionage.
-Additionally operation is near impossible to discover in retrospect.
+Additionally, operation is near impossible to discover in retrospect.
The goal of this project is to find means and methods of uncovering IMSI catchers that are active in the close perimeter.
-To that end the behaviour of such devices and the differences compared to legitimate base stations will be presented and analysed.
-These findings will then be used to implement the IMSI Catcher Detection System, a toolkit with a user friendly graphical interface to gather, analyse and visualise information.
+To that end, the behaviour of such devices and the differences compared to legitimate base stations will be presented and analysed.
+These findings will then be used to implement the IMSI Catcher Detection System, a tool with a user friendly graphical interface to gather, analyse and visualise information.
Evaluations against an IMSI catcher shows the effectiveness of the methods used by uncovering several realistic attacks.
The system itself builds upon an open source framework and harvests information about potential IMSI catchers while being invisible itself.
\vspace{.5cm}
-
+\newpage
\begin{center}
\textbf{Zusammenfassung:}\\
\vspace{.1cm}
@@ -30,6 +30,6 @@ Erschwerend kommt die Tatsache hinzu, dass der Einsatz kaum nachvollziehbar ist.
Ziel dieses Projektes ist es Vorgehensweisen zu finden, die den Betrieb eines IMSI-Catchers in der Umgebung aufdecken.
Um dies zu erreichen wird das Verhalten eines IMSI-Catchers analysiert und mit dem Verhalten einer legal betriebenen Basisstation verglichen.
Mit Hilfe dieser Ergebnisse wird dann das IMSI-Catcher Detection System entwickelt, ein Programm mit einer benutzerfreundlichen Oberfl\"ache, das dazu dient Informationen zu sammeln, auszuwerten und anzuzeigen.
-Auswertungen von Versuchen zum Auffinden echter IMSI-Catcher in verschiedenen realen Angriffsszenarien zeigen die Effektivität der eingesetzten Methoden.
-Das System selbst baut auf einem open source Framework auf, dass es erm\"oglicht Informationen von IMSI-Catchern zu empfangen und dabei selbst unentdeckt zu bleiben.
+Auswertungen von Versuchen zum Auffinden echter IMSI-Catcher, in verschiedenen realen Angriffsszenarien, zeigen die Effektivität der eingesetzten Methoden.
+Das System selbst baut auf einem open source Framework auf, das es erm\"oglicht Informationen von IMSI-Catchern zu empfangen und dabei selbst unentdeckt zu bleiben.
diff --git a/Tex/Content/Acknowledgements.tex b/Tex/Content/Acknowledgements.tex
index 5e8e5e5..af16cd7 100644
--- a/Tex/Content/Acknowledgements.tex
+++ b/Tex/Content/Acknowledgements.tex
@@ -3,15 +3,15 @@
\end{center}
This thesis would not have been possible without the guidance and the help of several individuals who in one way or another contributed and extended their valuable assistance in the preparation and completion of this project.
-First and foremost I want to thank my supervisor Dennis Wehrle for sacrificing a considerable amount of time reading and annotating my drafts. His constructive comments were of the utmost help in improving the quality of this document.
+First and foremost, I want to thank my supervisor Dennis Wehrle for sacrificing a considerable amount of time reading and annotating my drafts. His constructive comments were of the utmost help in improving the quality of this document.
He also gave me valuable hints and new ideas while discussing the methods used in this project.
I also want to thank Konrad Meier for helping me out whenever I was stuck, especially with the programming part in the OsmocomBB framework.
-My gratitude also goes to the Chair of Communication Systems and Prof. Schneider for providing this interesting topic and all the expensive, shiny toys and infrastructure I needed to complete this research.
+My gratitude also goes to the Chair of Communication Systems and Prof. Schneider for providing this interesting topic and all the expensive shiny toys and infrastructure I needed to complete this research.
I also wish to thank my mother, her husband and the rest of my family for constantly supporting me throughout the course of my studies.
-Last but not least I want to express my gratitude to my invaluable friends that I got to know during the last seven years.
+Last but not least, I want to express my gratitude to my invaluable friends that I got to know during the last seven years.
Thank you for always being there when I needed you and for the great projects that we finished together.
diff --git a/Tex/Content/Appendix.tex b/Tex/Content/Appendix.tex
index e026b84..4aa96b9 100644
--- a/Tex/Content/Appendix.tex
+++ b/Tex/Content/Appendix.tex
@@ -394,7 +394,7 @@ Neighbours &806, 815, 817, &806, 815, 817, \\
\end{tabular}
\caption{Configurations used for the rx\,/\,LAC Change Rules test.}
\end{table}
-
+\newpage
\section{Database Rules Test}
\label{sec:long_term_test}
The following table contains the two configurations used to test the Database Rules.
diff --git a/Tex/Content/Conclusion.tex b/Tex/Content/Conclusion.tex
index 8c27e18..3a590b5 100644
--- a/Tex/Content/Conclusion.tex
+++ b/Tex/Content/Conclusion.tex
@@ -62,3 +62,14 @@ On the other hand a regular base station using encryption can also be verified t
These approaches are not strictly passive since they require another participant to become active.
Although not strictly passive the \gls{icds} would still be invisible thus fulfilling the premise of not being uncovered itself.
+\paragraph{}This thesis analysed the threats that an IMSI catcher poses an which security flaws are responsible for its success.
+The main security flaw used in \gls{gsm}, namely authentication not being mutual, is fixed in the next generation \gls{umts} networks.
+However the topic will be of importance for years to come since as long as \gls{umts} coverage is not complete mobile phones will continue to have a fallback mechanism to look for \gls{gsm} cells when no \gls{umts} cells are available.
+To force a mobile phone to fall back to \gls{gsm} an IMSI catcher operator could jam the \gls{umts} frequency band and wait until the \gls{ms} connects.
+
+The results show that it is possible to identify suspicious base stations and therefore lessen the thread of being caught.
+
+We presented, with the \gls{icds}, a step into the direction of more security aware systems.
+A step that could and should also be taken by telephone manufacturers when designing the firmware and operating system for their next device.
+
+
diff --git a/Tex/Content/GSM_short.tex b/Tex/Content/GSM_short.tex
index b9b44ca..9966597 100644
--- a/Tex/Content/GSM_short.tex
+++ b/Tex/Content/GSM_short.tex
@@ -2,32 +2,32 @@
\label{ch:gsm}
This chapter will give a short overview of some important aspects of \gls{gsm} networks and protocols.
The first section presents a brief historical summary on the evolution of \gls{gsm} and how it came to be what it is today.
-In Section \ref{sec:network} the system architecture and its components as well as essential protocol basics will be explained important to understand which place in the network an IMSI catcher tries to take over.
-The $U_m$ interface will be described in detail in Section \ref{sec:Um} since this is the main source for gathering information from IMSI catchers.
-Section \ref{sec:catcher} will finally explain how an IMSI catcher works and how it replaces the system components as well as state from a technical and law perspective why these devices have become a threat to all-day privacy.
+In Section \ref{sec:network} the system architecture with its components and some essential protocol basics will be explained as far as it is necessary to understand which place in the network an IMSI catcher tries to take over.
+The $U_m$ interface will be described in detail in Section \ref{sec:Um} since this is our main source for gathering information from IMSI catchers.
+Section \ref{sec:catcher} will finally explain how an IMSI catcher works and how it replaces the system components, as well as state from a technical and law perspective why these devices have become a threat to all-day privacy.
\section{A Historical Perspective}
The acronym GSM was originally derived from \emph{Group Sp\'{e}ciale Mobile}.
-This committee was part of the \gls{cept} 1982, with the task of developing a pan-Eurpean digital cellular mobile radio standard in the 900\MHz band.
-In 1986 the frequency range was officially licensed.
-The foundation of this task group was a direct answer to the development of independent and incompatible analog radio networks during the 80's.
+This committee was part of the \gls{cept}, 1982, with the task of developing a pan-Eurpean digital cellular mobile radio standard in the 900\MHz band.
+In 1986, the frequency range was officially licensed.
+The foundation of this task group was a direct answer to the development of independent and incompatible analog radio networks during the 1980's.
Examples of such networks were the C-Netz in Germany, the \gls{tacs} in the UK and \gls{nmt} in Scandinavia.
-In February 1987 the committee submitted the basic parameters of GSM.
-Not after, in September, the \gls{MoU} was signed in Copenhagen by 15 members of 13 countries that were dedicated to deploy GSM in their respective countries.
+In February 1987, the committee submitted the basic parameters of GSM.
+Not long after, in September, the \gls{MoU} was signed in Copenhagen by 15 members of 13 countries that were dedicated to deploy GSM in their respective home countries.
This agreement was the foundation for allowing international operation of mobile stations using the standard interfaces agreed upon earlier that year.
\gls{cept} itself was around since 1959 and its members founded the \gls{etsi} in 1988.
In the same year the committee submitted the first detailed specification for the new communications standard.
-The acronym was reinterpreted in 1991 after the committee became a part of the \gls{etsi} in 1989 to \emph{Global System for Mobile Communications}.
-The very same year the specifications for \gls{dcs1800} were submitted.
+The acronym was reinterpreted in 1991, after the committee became a part of the \gls{etsi} in 1989, to \emph{Global System for Mobile Communications}.
+The very same year, the specifications for the \gls{dcs1800} were submitted.
These were essentially the same specifications translated to the 1800\MHz band and the basis for the USA's 1900\MHz band.
Under the umbrella of the \gls{etsi}, many \glspl{stc} began to work on different aspects of mobile communication, like network aspects (SMG 03) or security aspects (SMG 10).
SMG 05 dealt with future networks and especially with UMTS specifications which eventually became an independent body inside the \gls{etsi}.
-In 1992 many European countries had operational mobile telephone networks.
-These networks were a huge success, and as early as 1993 they already counted more than one million subscribers \cite{GSM2009}.
-Also many networks on different frequency bands (900\MHz, 1800\MHz, 1900\MHz) were started outside Europe in countries like the US or Australia with Telstra as the first non European provider.
-The rapid growth of mobile subscribers worldwide until today can be seen in figure \ref{fig:gsm_growth}.
+In 1992, many European countries had operational mobile telephone networks.
+These networks were a huge success and as early as 1993, they already counted more than one million subscribers \cite{GSM2009}.
+Many networks on different frequency bands (900\MHz, 1800\MHz, 1900\MHz) were started outside Europe in countries like the US or Australia with Telstra as the first non European provider.
+The rapid growth of mobile subscribers worldwide until today can be seen in Figure \ref{fig:gsm_growth}.
Three of the main reasons for this rapid growth are explained by Heine \cite{protocols1999} as:
\begin{itemize}
\item Liberalisation of the mobile market in Europe which allowed for competition and thus resulting in lower prices and enhanced development.
@@ -70,17 +70,18 @@ Three of the main reasons for this rapid growth are explained by Heine \cite{pro
%\caption{The 3GPP Logo}
%\end{figure}
-In 1998 the \gls{3gpp} was founded by five organisational partners with the goal of standardisation of mobile communications with focus on developing specifications for a third generation mobile radio system.
+In 1998, the \gls{3gpp} was founded by five organisational partners.
+Their goal was standardisation of mobile communications with focus on developing specifications for a third generation mobile radio system.
These partners were the \gls{arib}, the \gls{etsi}, the \gls{atis}, the \gls{tta} and the \gls{ttc}.
The focus was later expanded in the light of the \emph{International Mobile Communications-2000}-project \cite{3gpp_Proposal2000} by the \gls{itu} to:
\begin{itemize}
- \item Development and maintenance of \gls{gsm} and \gls{gprs}, including \gls{edge} which are standards for high speed packet oriented data transmission via \gls{gsm}.
+ \item Development and maintenance of \gls{gsm} and \gls{gprs}, including \gls{edge}, which are standards for high speed packet oriented data transmission via \gls{gsm}.
\item Development of a third generation mobile communication system on the basis of the old \gls{gsm} protocol. This standard is called \gls{umts}.
\item An IP based multimedia system.
\end{itemize}
-Up to now the \gls{3gpp} has enhanced mobile standards.
+Up to now, the \gls{3gpp} has enhanced mobile standards.
In 2005 the first \gls{hsdpa} network went online.
-\gls{hsdpa} \cite{hsdpa} is a protocol that enables mobile users to download data with speeds up to 84\,MBit/s since release 9.
+\gls{hsdpa} \cite{hsdpa} is a protocol that enables mobile users to download data with speeds of up to 84\,MBit\,/\,s since release 9.
\gls{hsupa} \cite{hsupa} is a related protocol in the \gls{hspa} family that provides similar functionality for uploading data.
These and other specification are published on the \gls{3gpp} website\footnote{3GPP - Specification Groups, \url{http://www.3gpp.org/Specification-Groups} [Online; Accessed 04.2012]}.
@@ -97,32 +98,33 @@ The main components of a \gls{gsm} network can be seen in Figure \ref{fig:gsm_ne
\label{fig:gsm_network}
\end{figure}
There are different notions of how to distribute these components into functional entities.
-In the following the classification by Sauter \cite{kommsys2006} will be used.
+In the following, the classification by Sauter \cite{kommsys2006} will be used.
It describes the main parts as:
\begin{itemize}
\item \gls{bss}: this part is also called radio network and contains all the technology necessary for connecting mobile subscribers to the telephone network and routing their calls.
- These calls originate from the \gls{ms} that will be explained in Section \ref{sec:ms}, and travel over the air interface to the receiver stations for further processing.
+ These calls originate from the \gls{ms} that will be explained in Section \ref{sec:ms} and travel over the air interface to the receiver stations for further processing.
The air interface or $U_m$ interface will be explained in Section \ref{sec:Um}, whereas the rest of the subsystem will be discussed in Section \ref{sec:bss}.
\item \gls{nss}: the core network, as it is sometimes called, consists of several entities that are used to establish and route a connection.
This is not only limited to calls within the provider's network but also into other providers' networks or the \gls{pstn}.
The databases that contain subscriber information and location information for connected users are located here.
\item \gls{in}: this part of the network augments the core network with \gls{vas} \cite{ITU1200}.
- In order to provide extra functionality the \gls{in} consists of several \gls{scp} databases.
+ In order to provide extra functionality, the \gls{in} consists of several \gls{scp} databases.
Some of the most widely used services are in fact services of the \gls{in} and not core services.
Examples are prepaid cards, home areas\footnote{This service defines a geographical area, in which lower rates are calculated for mobile calls.} or telephone number portability.
\end{itemize}
Other sources define the \gls{oms} \cite{GSM2009} or limit the \gls{bss} entity to the provider part and define an additional entity for the \gls{ms} \cite{overview1994, overview1996}.
-The system developed in this project works inside the base station subsystem acting the part of a passive, information gathering \gls{ms}.
-Therefore the following theory section will focus mainly on this part, including the radio interface between the phone and the base station to establish a basic understanding of how the system is able to passively harvest information.
+The system presented in this project works inside the base station subsystem, acting the part of a passive, information gathering \gls{ms}.
+Therefore, the following theory section will focus mainly on this part, including the radio interface between the phone and the base station to establish a basic understanding of how the system is able to passively harvest information.
The \gls{nss} will only be discussed as far as it is relevant to understanding how an IMSI catcher operates.
-Since the \gls{in} is not involved in any procedure concerning this project further explanation will be omitted.
+Since the \gls{in} is not involved in any procedure concerning this project, further explanation will be omitted.
\subsection{Mobile Station}
\label{sec:ms}
-With the advent of portable microprocessors in the 80's mobile phones became technically possible.
-Advances in technology up to today yielded ever smaller mobile phones with ever more functionality year by year to a point where not the technology itself was the constraining factor for size but the user interface, \eg button and display sizes.
-This trend changed however with the upcoming of so called smart-phones.
+With the advent of portable microprocessors in the 1980's mobile phones became technically possible.
+Advances in technology up to today yielded ever smaller mobile phones with ever more functionality.
+Year by year, this process continued until not the technology itself was the constraining factor for size but the user interface, \eg button and display sizes.
+This trend changed with the upcoming of so called smart phones.
With weight being the driving factor and not size, resolution and display sizes started to increase again but the devices became ever thinner.
What hasn't changed is the basic distinction between \gls{me} and \gls{sim}, the parts of which a \gls{ms} consists.
@@ -134,7 +136,7 @@ Some of the most important mandatory features are \cite{protocols1999}:
\item \gls{sms} capability.
\item The ciphering algorithms A5/1 and A5/2 need to be implemented.
\item Display capability for short messages and dialled numbers, as well as available \glspl{plmn}.
- \item A cyphering indicator that shows the user whether encryption is activated on the current connection or not.
+ \item A ciphering indicator that shows the user whether encryption is activated on the current connection or not.
This feature is disabled in most devices as not to confuse the user.
\item Machine fixed \gls{imei}.
In a strict sense this disqualifies many modern mobile phones since the \gls{imei} is not fixed onto the device itself but is rather part of the software or firmware.
@@ -142,15 +144,16 @@ Some of the most important mandatory features are \cite{protocols1999}:
\end{itemize}
A common way to categorise different phones was to group them by the band they support.
-However it is more common nowadays that \gls{me} supports two bands, three bands or even all four bands.
+However, it is more common nowadays that \glspl{me} support two bands, three bands or even all four bands.
These are called dual-band, tri-band and quad-band devices respectively.
-As the name suggests the \gls{sim} card is essentially a data storage that holds user specific data.
+As the name suggests, the \gls{sim} card is essentially a data storage that holds user specific data.
This separation is interesting for the \gls{gsm} user since it allows him\,/\,her to exchange the \gls{me} without having to contact the provider.
-Thus it can be used on different frequency bands and is one of the preconditions for roaming.
-The \gls{sim} card can either be in plug-in format or ID-1 SIM format which is normally used for telephone cards, credit cards or car installed \gls{me}.
+Thus the same \gls{sim} card can be used on different frequency bands which is one of the preconditions for roaming.
+It card can either be in plug-in format or ID-1 SIM format.
+The latter one is normally used for telephone cards, credit cards or car installed \glspl{me}.
-A subset of other parameters stored on the \gls{eeprom} of the card can be seen in Table \ref{tab:simdata}.
+A subset of parameters stored on the \gls{eeprom} of the card can be seen in Table \ref{tab:simdata}.
The most important information stored on a \gls{sim} card are the \gls{imsi} and the \gls{ki}.
\begin{table}
@@ -174,17 +177,17 @@ MSISDN &Telephone number\\
\midrule
\multicolumn{2}{l}{Network Related}\\
\midrule
-LAI &Identifier of the current location area\\
+LAI &Identifier of the current Location Area\\
TMSI &Temporary IMSI\\
Home PLMN &Multiple entries to identify the home PLMN\\
\bottomrule
\end{tabular}
-\caption{Subset of data stored on a SIM card. Adopted from \cite{protocols1999}}
+\caption{Subset of data stored on a SIM card. Adopted \cite{protocols1999}}
\label{tab:simdata}
\end{table}
This key is used to generate the \gls{kc}, as will be explained in Section \ref{sec:nss}.
-Most of this data, although not the security relevant \gls{ki} and \gls{kc} can be read via a USB \gls{sim} card reader, which can be bought for around \$10 on the web.
+Most of this data, although not the security relevant \gls{ki} and \gls{kc}, can be read via a USB \gls{sim} card reader which can be bought for around \$10 on the web.
Since \gls{ki} never leaves the card, \gls{kc} has to be dynamically generated on the card.
This can be done since the card itself has a microprocessor that manages the security relevant data.
Key functions, like running the \gls{gsm} key algorithm, verifying a \gls{pin} or reading a file can be accessed through the microprocessor via a communication protocol.
@@ -192,15 +195,15 @@ A brief description of the protocol and functionalities can be found in Sauter's
The \gls{imsi} as described in GSM 23.003 \cite{GSM23003} uniquely identifies a subscriber.
It has at most 15 digits and is divided into three parts, \gls{mcc}, \gls{mnc} and \gls{msin} of which only the last part is the personal identification number of the subscriber.
-\[\underbrace{262}_{\text{MCC (Germany)}} \underbrace{01}_{\text{MNC (T-Mobile)}} \underbrace{9876543210}_{MSIN}\]
-The first two groups together are also called \gls{hni}.
-The three digit \gls{mcc} describes the country code, the area of domicile of the mobile subscriber.
+\[\underbrace{262}_{\text{MCC (Germany)}} \underbrace{01}_{\text{\phantom{aa}MNC (T-Mobile)\phantom{aa}}} \underbrace{9876543210}_{MSIN}\]
+The first two groups together are called \gls{hni}.
+The three digit \gls{mcc} describes the country, the area of domicile of the mobile subscriber.
The \gls{mnc} is an identification number for the home \gls{plmn}.
It can either have two or three digits depending on the \gls{mcc}.
It is not recommended by the specification and thus not defined to mix two and three digit \gls{mnc}s for a single \gls{mcc}.
These country codes are assigned by the \gls{itu} in ITU E.212 \cite{ITU212}.
An excerpt can be found in Table \ref{tab:countrycodes}.
-The third part, the \gls{msin} is a number consisting of up to ten digits which is used for authenticating the mobile subscriber against the network.
+The third part, the \gls{msin} is a number consisting of up to ten digits, which is used for authenticating the mobile subscriber against the network.
\gls{mnc} and \gls{msin} together are called \gls{nmsi}.
\begin{table}
\centering
@@ -210,12 +213,12 @@ The third part, the \gls{msin} is a number consisting of up to ten digits which
Country &MCC\\
\midrule
Germany &262\\
-France &208\\
+Australia &505\\
USA &310 - 316\\
UK &234 - 235\\
Switzerland &228\\
Austria &232\\
-Poland &260\\
+France &208\\
\bottomrule
\end{tabular}
}
@@ -241,19 +244,19 @@ A1 &Austria &01, 09\\
\subsection{Network Subsystem}
\label{sec:nss}
-The most important task of the Network Subsystem or Network Switching Subsystem is to establish connections and route calls between different locations.
-This is done by the so called \gls{msc} that can route a call either to another \gls{msc}, into the \gls{pstn} or another provider's network.
+The most important task of the Network Subsystem, or Network Switching Subsystem, is to establish connections and route calls between different locations.
+This is done by the so called \gls{msc} that can route a call either to another \gls{msc}, into the \gls{pstn} or into another provider's network.
Apart from routing, the \gls{nss} also provides the means to administer subscribers inside the network.
-Facilities to support this task are the \gls{hlr}, the \gls{vlr} as well as the \gls{ac}.
+Facilities to support this task are the \gls{hlr}, the \gls{vlr} and the \gls{ac}.
These will now be described in further detail.
A possible arrangement of these components is displayed in Figure \ref{fig:gsm_network}.
-The \gls{eir} shown in the picture can be thought of as a database containing lists whether to allow a particular \gls{imsi} access to the network or not.
+The \gls{eir} shown in the picture can be thought of as a database containing lists with information on whether to allow a particular \gls{imsi} access to the network or not.
\subsubsection{Mobile Switching Center}
The \gls{msc} is the component that does the actual routing of calls and therefore is the core component of the \gls{nss}.
It basically works like any other \gls{isdn} exchange device with additional functionality to manage mobility.
Since the amount of signalling inside a \gls{plmn} would be far too much for a single \gls{msc} there is one for every \gls{la}.
-Amongst others its most important tasks are \gls{cc} and \gls{mm}.
+Amongst others, its most important tasks are \gls{cc} and \gls{mm}.
\gls{cc} entrails registration when the subscriber connects to the network as well as routing the calls or text messages from one registered subscriber to another.
This routing can include transmission of calls to landlines or to networks of other providers.
@@ -263,8 +266,8 @@ The above part is also true for pure landline switching centres.
What sets a mobile switching centre apart from these is called \gls{mm}.
Since the participants can freely move around the network and thus cannot be identified the same way as a fixed landline participant, authentication before using the offered services is important.
Another consequence of mobility is that the network has to keep track of where a subscriber is and through which \gls{msc} it can be reached.
-This is done via \emph{Location Updates} which update the current location in the databases for other \glspl{msc} to look up.
-Also during calls if the subscriber leaves the respective service area of the switching centre, the call needs to be transferred without being interrupted.
+This is done via \emph{Location Updates}, which update the current location in the databases for other \glspl{msc} to look up.
+Also during active calls, if the subscriber leaves the respective service area of the switching centre, the call needs to be transferred to the new switching centre without being interrupted.
A procedure called \emph{Handover} achieves just that.
For this central role to work it is necessary to be connected to all the other components of the \gls{nss}.
@@ -274,24 +277,25 @@ A brief description of what the different interfaces in a \gls{gsm} network are
\subsubsection{Home Location Register}
The \gls{hlr} is the central database in which all subscriber related data is stored.
The entries can be divided into two classes, permanent administrative and temporary data.
-Part of this administrative data is which services a subscriber has access to and which are prohibited (\eg roaming in certain networks).
+Part of this administrative data is, which services a subscriber has access to and which are prohibited (\eg roaming in certain networks).
The data itself is indexed with the customer's \gls{imsi} to which multiple telephone numbers can be registered.
-Since these \glspl{msisdn} are independent from the \gls{imsi} a subscriber can change his telephone number and thus also move the telephone number along should he\,/\,she decide to switch to a new provider.
+Since these \glspl{msisdn} are independent from the \gls{imsi} a subscriber can change his telephone number and also take the telephone number along should he\,/\,she decide to switch to a new provider.
+
Access to basic services is stored inside the \gls{hlr}.
Examples of such services are the ability to receive and initiate telephone calls, use data services or send text messages.
Additional services called Supplementary Services like call forwarding or display of phone numbers during calls can also be set or unset in this database.
It is up to the provider if these services are available freely or are bound to a fee.
-The temporary data enfolds the current \gls{vlr} and \gls{msc} address as well as the \gls{msrn} which is essentially a temporary location dependent ISDN number.
+The temporary data enfolds the current \gls{vlr} and \gls{msc} address as well as the \gls{msrn}, which is essentially a temporary location dependent ISDN number.
\subsubsection{Visitor Location Register}
As can be seen in Figure \ref{fig:gsm_network} there can be multiple \glspl{vlr}, one for each area in a network.
These registers can be seen as caches for data located in the \gls{hlr}.
-Thus they are intended to reduce signalling between the \gls{msc} and the \gls{hlr}.
+They are intended to reduce signalling between the \gls{msc} and the \gls{hlr}.
Each time a subscriber enters a new area that is serviced by a new \gls{msc}, data for this subscriber is transferred to the respective \gls{vlr} from the central \gls{hlr}.
Such data includes the \gls{imsi} and the \gls{msisdn} as well as information on which services are available to that particular subscriber.
-Additionally the subscriber is assigned a one-time \gls{imsi} called \gls{tmsi} and the \gls{la} in which the \gls{ms} was registered last is transmitted.
-In this way the regular \gls{imsi} is not used and can thus not be harvested by tapping into the radio channel.
-While it is possible to operate the \gls{vlr} as a standalone entity, in most cases it is implemented as a software component of the individual \gls{msc}.
+Additionally, the subscriber is assigned a temporary replacement \gls{imsi} called \gls{tmsi} and the \gls{la} in which the \gls{ms} was registered last is transmitted.
+In this way, the regular \gls{imsi} is not used and as a result can not be harvested by tapping into the radio channel.
+While it is possible to operate the \gls{vlr} as a standalone entity, in most cases it is implemented as a software component of the \gls{msc} \cite{kommsys2006}.
\begin{figure}
\centering
@@ -304,18 +308,18 @@ While it is possible to operate the \gls{vlr} as a standalone entity, in most ca
\label{sec:authentication}
The \gls{ac} is the network component responsible for authenticating mobile subscribers.
It is a part of the \gls{hlr} and the only place apart form the customer's \gls{sim} card where the secret key \gls{ki} is stored.
-The authentication is not only done once when the subscriber connects to the network but rather on many occasions \eg the start of a call or other significant events to avoid misuse by a third party.
+The authentication is not only done once when the subscriber connects to the network but rather on many occasions, \eg the start of a call or other significant events to avoid misuse by a third party.
This authentication routine is a key based challenge-response procedure\footnote{A procedure where one party poses a question, a so called challenge and the party to be authenticated has to provide a valid answer.} outlined in Figure \ref{fig:authentication}.
The steps of the procedure can be summarized as follows:
\begin{enumerate}
- \item User connects to the network or triggers an event that needs authentication at the \gls{msc}.
+ \item The user connects to the network or triggers an event that needs authentication at the \gls{msc}.
There are two possible scenarios from here on.
In the first case the \gls{imsi} is part of the authentication request and the \gls{ac} starts with searching for the corresponding \gls{ki} and authentication algorithm A3.
An authentication triplet is built using \gls{ki} which consists of the components:
\begin{itemize}
\item RAND: a 128 bit random number.
- \item SRES: a 32 bit number called signed response, which is generated by A3 with \gls{ki} and RAND as inputs.
+ \item SRES: a 32 bit number, called signed response, which is generated by A3 with \gls{ki} and RAND as inputs.
\item Kc: the ciphering key that is used to cipher the data during transmission.
It is also generated with \gls{ki} and RAND using the algorithm A8.
\end{itemize}
@@ -331,21 +335,21 @@ The steps of the procedure can be summarized as follows:
\end{enumerate}
Remarkable properties of this procedure are that by using a ciphering key that is generated by a random number and a secret key, the secret key itself never leaves the \gls{ac}.
-Apart from that the use of a random number prevents replay attacks on SRES.
+Apart from that, the use of a random number prevents replay attacks on SRES.
It should also be noted that this way of authenticating only works for authenticating the subscriber to the network.
It is a one way authentication.
The subscriber needs to trust the network.
This is the basic design flaw that IMSI catchers abuse.
In \gls{umts} networks that flaw was fixed and the authentication procedure was made mutual \cite{kommsys2006}.
-However since it will take considerable time until all areas are services by \gls{umts}, phones still have a fall-back mechanism to use \gls{gsm} if no \gls{umts} station is available.
+However since it will take considerable time until all areas are services by \gls{umts}, phones still have a fallback mechanism to use \gls{gsm} if no \gls{umts} station is available.
\subsection{Base Station Subsystem}
\label{sec:bss}
The \gls{bss} is the part of the network that provides the hard- and software for physically connecting \glspl{ms} to the provider's network.
Its main components are the \gls{bsc}, the \gls{bts} and the \gls{trau}.
Connecting a mobile subscriber works via radio which is why this subsystem is sometimes also called the radio network \cite{kommsys2006}.
-Inside the radio network of a certain area there is one \gls{bsc} that connects to multiple \glspl{bts} and one more \glspl{trau} depending on whether the \gls{trau} is attached to the \gls{bsc} or to all the \glspl{bts}.
-While the Transceiver station acts as receiver for radio signals the controller coordinates the different receivers and relays the incoming signals to the core network.
+Inside the radio network of a certain area, there is one \gls{bsc} that connects to multiple \glspl{bts} and one more \glspl{trau} depending on whether the \gls{trau} is attached to the \gls{bsc} or to all the \glspl{bts}.
+While the transceiver station acts as receiver for radio signals the controller coordinates the different receivers and relays the incoming signals to the core network.
Since signals inside the core network are transmitted at other rates than in the radio network, rates need to be adapted which is done by the \gls{trau}.
Before discussing the individual components of this subsystem it is important to understand how the frequencies of the radio network are used and what architectural impacts this sparse resource has on the network and the components itself.
@@ -359,7 +363,7 @@ Before discussing the individual components of this subsystem it is important to
\end{figure}
A frequency band as shown in Figure \ref{fig:frequency} is distributed into different functional entities.
-The band is divided into a range for the uplink, the part that is used by the \gls{ms} to upload data into the network and the downlink, that is utilised by the network to send data back.
+The band is divided into a range for the uplink, the part that is used by the \gls{ms} to upload data into the network and the downlink that is utilised by the network to send data back.
In the 900\MHz band each of these has a width of 25\MHz.
These bands themselves are furthermore divided into channels, each spanning 200\,kHz, which accounts for 125 channels on 25\MHz.
@@ -388,30 +392,31 @@ Each of which is identified by its \gls{arfcn}.
This is a simple numbering scheme, given to those 200\,kHz channels.
The frequencies and \glspl{arfcn} are connected as follows:
\begin{align}
-F_\text{Uplink} &= \text{Start}_\text{Band} + 0.2 \cdot (\text{ARFCN} -(\text{Start}_\text{ARFCN} -1))\\
-F_\text{Downlink} &= F_\text{Uplink} + \text{Offset}_\text{Band}
+F_\text{Uplink} &= \text{Band}_\text{Start} + 0.2\,\text{MHz} \cdot (\text{ARFCN} -\text{ARFCN}_\text{Start})\\
+F_\text{Downlink} &= F_\text{Uplink} + \text{Band}_\text{Offset}
\end{align}
In case of the 900 MHz Band this would be:
\begin{align}
-F_\text{Uplink} &=890 + 0.2 \cdot (\text{ARFCN} - (1-1))\\
+F_\text{Uplink} &=890 + 0.2 \cdot (\text{ARFCN} - 0)\\
&=890 + 0.2 \cdot \text{ARFCN}\\
F_\text{Downlink} &=F_\text{Uplink} + 45
\end{align}
-For other bands the numbers differ and can be seen in Table \ref{tab:frequencies} along with their respective \gls{arfcn} numbers but the functionality is the same.
+For other bands the numbers differ but the functionality is the same.
+They can be seen in Table \ref{tab:frequencies} along with their respective \gls{arfcn} numbers
-An additional method called time multiplexing which will be explained in further detail in Section \ref{sec:Um}, makes is possible to map $125 \cdot 8 = 1000$ channels that could be used for voice transmission onto that band.
+An additional method called time multiplexing, which will be explained in further detail in Section \ref{sec:Um}, makes is possible to map $125 \cdot 8 = 1000$ channels onto that band that could be used for voice transmission.
Some of these channels need to be used for signalling.
-Even though the number by itself seems high it would never suffice to service a large urban area.
+Even though the number by itself seems high, it would never suffice to service a large urban area.
This is one of the reasons why another frequency band in the 1800\MHz range has been opened with 75\MHz up- and downlink supporting 375 channels.
-That by itself would also never suffice to service the huge number of subscribers therefore the \gls{gsm} network like any other modern mobile radio network is based on a cellular architecture which makes it possible to reuse frequencies.
+That by itself would also never suffice to service the huge number of subscribers, therefore, the \gls{gsm} network like any other modern mobile radio network is based on a cellular architecture which makes it possible to reuse frequencies.
The range of one receiver station is drastically reduced to service only a small area.
This is called the cell of the \gls{bts} which in theory can be approximated by a hexagon, each of which has its own \glspl{cid}.
Each of these cells is assigned a different frequency to avoid interference.
-However after a certain distance, \emph{frequency reuse distance} $D$, is covered the exact same frequency can be used again by another \gls{bts}.
-$D$ is chosen large enough so that interference doesn't have an impact on overall call quality.
+However, after a certain distance, the \emph{frequency reuse distance} $D$, is covered the exact same frequency can be used again by another \gls{bts}.
+$D$ is chosen large enough, so that interference does not have an impact on overall call quality.
Figure \ref{fig:cells} shows such an arrangement.
-Also a comparison with realistic cells can be seen which differ in their appearance from the optimized hexagon model.
+Also, a comparison with realistic cells can be seen which differ in their appearance from the optimized hexagon model.
The borders are blurred because of interference, reflection- and shadowing effects and cells in the more urban areas are smaller than cells on the countryside, where the density of subscribers is less and thus can be handled by fewer \glspl{bts}.
The band has been divided into seven frequencies which are only reused (cells with the same number) after distance $D$ is covered.
For an arbitrary division of the frequency band into $k$ partitions and a cell radius of $R$ geometric derivations from the hexagon model yield for the frequency reuse distance $D$ \cite{GSM2009}:
@@ -419,7 +424,7 @@ For an arbitrary division of the frequency band into $k$ partitions and a cell r
D &=R\cdot\sqrt{3k}
\end{align}
-This procedure raises the number of effectively usable by a large factor.
+This procedure raises the number of effectively usable frequencies by a large factor.
However certain disadvantages come with this procedure as well \cite{protocols1999}.
Increasing the amount of receivers automatically increases the cost of infrastructure for the provider.
Due to the nature of the mobility of subscribers this increases the amount of Handovers needed since it is more likely that a subscriber leaves a small cell during an active call.
@@ -436,20 +441,20 @@ These inflict increased signalling load on the network itself.
\subsubsection{Base Transceiver Station}
They are also called base stations and are the entry points to the network for subscribers.
-Theoretically a \gls{bts} can serve a cell of 35\,km radius however this is decreased by interference, reflection- and shadowing effects.
-Also this is the theoretical limit for a cell on the 900\MHz band.
-A 1800\MHz cell has a lower coverage since the signal falloff is greater due to the shorter wavelength.
+Theoretically, a \gls{bts} can serve a cell of 35\,km radius, however, this is decreased by interference, reflection- and shadowing effects.
+This is the theoretical limit for a cell on the 900\MHz band.
+A cell on the 1800\MHz band has a lower coverage since the signal falloff is greater due to the shorter wavelength.
The limiting factor here are the number of subscribers itself.
A single station can only serve a limited number of users which yields a radius as low as 100\,m for a single \gls{bts} in urban housing areas \cite{kommsys2006} with high population density.
-On the countryside where population is less dense the constraining factor can also be transmission power of the \gls{me}.
-Therefore cells with a radius of above 15\,km are seldom seen.
+On the countryside where population is less dense, the constraining factor can be the transmission power of the \gls{me}.
+Therefore, cells with a radius of above 15\,km are seldom seen.
\glspl{bts} and their corresponding cells can have different configurations depending on load or morph structure of the surroundings.
In a \emph{standard configuration} every base station has its own \gls{cid}, it is a one to one mapping of cells to \gls{bts}.
-This is a cost effective way of providing service to a rural or sparse settled area since only one \gls{bts} is used to cover a large area.
-For urban, densely settled areas the \emph{sectorised configuration} has become the de facto standard.
-The main idea is to not have a $360^\circ$ coverage for a base station handling a cell but rather split the cell in multiple sectors, each with its own \gls{bts} covering $120^\circ$ for example.
-This way the amount of subscribers in the cell will be divided over three \gls{bts} instead of one in a standard configuration.
+This is a cost effective way of providing service to a rural or sparse settled area, since only one \gls{bts} is used to cover a large area.
+For urban densely settled areas, the \emph{sectorised configuration} has become the de facto standard.
+The main idea is to not have a $360^\circ$ coverage for a base station handling a cell but rather split the cell into multiple sectors, each with its own \gls{bts} covering $120^\circ$ for example.
+This way the amount of subscribers in the cell will be divided over three \glspl{bts} instead of one.
\subsubsection{Base Station Controller}
The \gls{bsc} is the central unit in the \gls{bss}.
@@ -457,11 +462,11 @@ It can be compared to a digital exchange in a standard telephone network with ad
The design idea was to remove all radio related load from the \gls{msc} into the radio subsystem.
Therefore a \gls{bsc} manages the multitude of \glspl{bts} in the \gls{bss}.
-First and foremost it is a switching centre.
-This means it has to switch incoming traffic channels from the \gls{msc} over the A-interface to channels on the outgoing A$_\text{bis}$-interface which leads over the \gls{bts} and thus the air interface to different \glspl{ms}.
-As a result the initialisation and maintenance of signalling and voice channels are its main tasks.
+First and foremost, it is a switching centre.
+This means it has to switch incoming traffic channels from the \gls{msc} over the A-interface to channels on the outgoing A$_\text{bis}$-interface, which leads over the \gls{bts} and thus the air interface to different \glspl{ms}.
+As a result, the initialisation and maintenance of signalling and voice channels are its main tasks.
What channels are and how they are established is explained in Section \ref{sec:channels}.
-For the sake of functional explanation of the \gls{bsc} it will suffice to regard channels as a communication line for a particular purpose like receiving or sending voice data or for sending broadcast information.
+For the sake of functional explanation of the \gls{bsc} it will suffice to regard channels as a communication line for a particular purpose, like receiving or sending voice data or for sending broadcast information.
Due to the nature of a mobile network certain other tasks have to be performed here as well, such as Handovers and power management \cite{kommsys2006}.
A \emph{signalling channel} is needed when a subscriber wants to start a call or send a text message.
@@ -492,44 +497,46 @@ The complete procedure is outlined in Figure \ref{fig:cypher}.
\label{fig:cypher}
\end{figure}
Some strong ciphering algorithms are not permitted in certain countries so there is a variety of algorithms called A5/0, A5/1 and A5/2 from which one needs to be chosen upon connecting to the network.
-However the encryption is only optional and not mandatory, the use of A5/0 indicates that no encryption is used.
-If the network does not offer such encryption, the \gls{me} sends its data unencrypted, without giving notice to the user in most cases.
-A ciphering indicator is part of most mobile phones, but on most models it is disabled by the operator to not confuse the customers.
+However, the encryption is only optional and not mandatory.
+The use of A5/0 indicates that no encryption is used.
+If the network does not offer such encryption, the \gls{me} sends its data unencrypted without giving notice to the user in most cases.
+A ciphering indicator is part of most mobile phones but on normally it is disabled by the operator as to not confuse the customers.
The other weakness is the locality of encryption.
The procedure only affects the transmission from the \gls{me} to the \gls{bts}, everything after that is unencrypted voice data.
-This is especially a problem when providers use point-to-point radio systems to connect their base stations to the \gls{msc}.
+This is especially a problem if providers use point-to-point radio systems to connect their base stations to the \gls{msc}.
-A \emph{Handover} is necessary when a subscriber leaves the area of a cell and needs to be assigned to another one or if the reception of the current cell at the subscriber's end is far worse than those of neighbouring cells.
-A Handover takes place during an active call therefore first of all a \gls{tch} in the target cell has to be activated.
-Once this is done the new cell address and frequency is sent to the \gls{ms} over the \gls{facch} along with a command that triggers the Handover.
-After synchronising with the new cell an acknowledgement is sent by the base station to the controller to switch the voice connection to the new cell.
+A \emph{Handover} is necessary when a subscriber leaves the area of a cell and needs to be assigned to another one while conducting a call.
+First of all a \gls{tch} in the target cell has to be activated since the call is still in progress.
+Once this is done, the new cell address and frequency is sent to the \gls{ms} over the \gls{facch} along with a command that triggers the Handover.
+After synchronising with the new cell, an acknowledgement is sent by the base station to the controller to switch the voice connection to the new cell.
What remains is freeing the old \gls{tch} for further use by other subscribers.
\section{The $U_m$ Interface}
\label{sec:Um}
-As with all radio based networks the efficiency of the wireless interface, the interface between the \gls{ms} and the \gls{bts} is of utmost importance to the overall performance of the network.
-The main reason for that is that resources on the air interface are scarce.
-Efficiency in this case can be seen as maximizing the quotient of transmission rate over bandwidth used \cite{protocols1999}.
+As with all radio based networks, the efficiency of the wireless interface, the interface between the \gls{ms} and the \gls{bts}, is of utmost importance to the overall performance of the network.
+The main reason is that resources on the air interface are scarce.
+Maximising efficiency in this case can be seen as maximizing the quotient of transmission rate over bandwidth used \cite{protocols1999}.
The first section will explain how transmission in a \gls{gsm} network is handled on the physical level and what techniques are used to maximize throughput.
-Afterwards the notion of logical channels, virtual channels that are mapped on top of the actual transmission, will be discussed and which channels are of importance for this project.
-The last section compares the network layers of the \gls{gsm} stack to the ISO\,/\,OSI layer model, to give a basis for understanding where the framework employed in the practical part is situated in that hierarchy.
+Afterwards, the notion of logical channels, virtual channels that are mapped on top of the actual transmission, will be discussed.
+It will be carved out which channels are of importance for this project.
+The last section outlines the network layers of the \gls{gsm} stack, to give a basis for understanding where the framework employed in the practical part is situated in that hierarchy.
\subsection{Radio Transmission}
\label{sec:radio}
Without additional techniques, the \gls{bts} would only be able to serve a single caller at a time.
-Therefore even in older radio networks like the C-Netz in Germany \gls{fdma} is used.
-With \gls{fdma} a specific frequency of the broad frequency band of the \gls{bts} is allocated to a specific subscriber for a call, leaving other frequencies open to use for other subscribers connected to the same base station.
+Therefore, even in older radio networks, like the C-Netz in Germany, \gls{fdma} is used.
+With \gls{fdma}, a specific frequency of the broad frequency band of the \gls{bts} is allocated to a specific subscriber for a call, leaving other frequencies open to be used by other subscribers connected to the same base station.
Essentially this means that every \gls{bts} can serve multiple frequencies at the same time.
-This comes at the cost of additional hardware, since all the frequencies need their own transceivers and need to be amplified accordingly to guarantee the transmission quality.
+This comes at the cost of additional hardware, since all the frequencies need their own transceivers and need to be amplified accordingly to guarantee transmission quality.
Additional hardware for each channel is also required to enable duplex transmission, meaning that sending and receiving can be done at the same time.
That number of available frequencies would not suffice to meet the demand, more communication channels were needed.
-To that end another technique has been introduced, called \gls{tdma}.
-In \gls{gsm} networks each of these sub-bands yielded by the \gls{fdma} procedure has a width of 200\,kHz.
-Onto this smaller carrier frequency, \gls{tdma} frames are transmitted, that contain eight time slots.
+To that end, another technique has been introduced, called \gls{tdma}.
+In \gls{gsm} networks, each of these sub-bands yielded by the \gls{fdma} procedure has a width of 200\,kHz.
+Onto this smaller carrier frequency, \gls{tdma} frames are transmitted that contain eight time slots.
These frames have a transmission length of 4.615\,ms.
-Each of these timeslots could host the data of a different subscriber, although the first two are usually used for signalling procedures.
+Each of these timeslots can host the data of a different subscriber, although the first two are usually used for signalling procedures.
An illustration of how these multiplexing methods work together can be seen in Figure \ref{fig:fdma_tdma}.
\begin{figure}
@@ -540,18 +547,18 @@ An illustration of how these multiplexing methods work together can be seen in F
\end{figure}
\subsubsection{Frame Numbering}
-Another important aspect is the frame hierarchy and the resulting frame numbering since it is used for ciphering as well as channel mapping and synchronisation.
+Another important aspect is the frame hierarchy and the resulting frame numbering, since it is used for ciphering as well as channel mapping and synchronisation.
The frame number is one of the inputs required to generate the ciphering key and is broadcasted frequently on the \gls{sch} to keep mobile subscribers in sync.
An overview of the numbering hierarchy is illustrated in Figure \ref{fig:frame_hierarchy}.
-The timeslots on the lowest level of the hierarchy have a length of $4.615\text{\,ms} \div 8 = 577~\mu\text{s}$ and are also known as \emph{Bursts} numbered from 0 to 7.
-Depending on what the Burst is used for the internal structure can differ but the duration is always the same.
-Every new \gls{tdma} frame the sequence number is increased by one.
+The timeslots on the lowest level of the hierarchy have a length of $4.615\text{\,ms} \div 8 = 577~\mu\text{s}$ and are also known as \emph{Bursts}, numbered from 0 to 7.
+Depending on what the Burst is used for, the internal structure can differ but the duration is always the same.
+Every new \gls{tdma} frame, the sequence number is increased by one.
Since this number cannot be increased endlessly it is repeated every 3\,h 28\,m 53\,s and 760\,ms.
This is the largest chunk in the frame hierarchy and it is called Hyperframe.
Superframes and Multiframes are layers between the Hyperframe and the \gls{tdma} frame which can occur in different configurations.
The 51-Multiframe consists of 51 TDMA frames and carries only signalling data whereas the 26-Multiframe contains 26 TDMA frames and carries traffic and control channels.
-Superframes can be seen as packages to wrap these different Multiframes in one package of the same length.
+Superframes can be seen as packages to wrap these different Multiframes in one packages of consistent lengths.
\begin{figure}
\centering
@@ -561,7 +568,7 @@ Superframes can be seen as packages to wrap these different Multiframes in one p
\end{figure}
When a \gls{ms} and \gls{bts} start to communicate the frame number has to be obtained by the \gls{ms} through the \gls{sch} before it can ask for a channel.
-This is important since the frame number is a vital information indicating the chronological order of control channels.
+This is important since the frame number is a vital information, indicating the chronological order of control channels.
If the \gls{ms} asks for a channel assignment in frame $n$ and a channel is assigned to the \gls{ms}, the assigned channels refers back to the frame $n$ and thus the \gls{ms} can find its channel amongst the others.
\begin{figure}
@@ -572,43 +579,43 @@ If the \gls{ms} asks for a channel assignment in frame $n$ and a channel is assi
\end{figure}
\subsubsection{Burst Types}
-As suggested by the paragraph above there are different kinds of Bursts which are shown in \ref{fig:burst_types} \cite{GSM2009}.
+As suggested by the paragraph above there are different kinds of Bursts which are shown in Figure \ref{fig:burst_types} \cite{GSM2009}.
In addition to \emph{data bits} and known fixed bit sequences every frame has \emph{tail bits}, which mark the beginning and the end of a frame.
The fixed bit sequence is called \emph{training sequence} and appears in conjunction with the data bit sequences.
During a radio transmission procedure the signal can be distorted by shadowing, reflection or other factors which would result in a loss of data.
-But since the training sequence is known it is possible to reconstruct the original signal by comparing the incoming training sequence with the expected one and thus conserving the data bits.
+But since the training sequence is known, it is possible to reconstruct the original signal by comparing the incoming training sequence with the expected one and thus conserving the data bits.
-All Bursts contain \emph{guard times} which separate them from the next Burst.
+All Bursts also contain \emph{guard times} which separate them from the next Burst.
This is necessary because subscribers can move around and thus slight variations in timing may occur.
-These variations could result in the collision of data from several different sources rendering it unusable.
-For subscribers that move at considerable speeds \eg in a car this is not sufficient and an extra mechanism called \emph{Timing Advance} is used.
-Basically the farther a subscriber is away from a base station the earlier a burst has to be sent, to compensate for the distance.
+These variations could result in the collision of data from several different sources, rendering it unusable.
+For subscribers that move at considerable speeds, \eg in a car, this is not sufficient and an extra mechanism called \emph{Timing Advance} is used.
+Basically, the farther a subscriber is away from a base station the earlier a burst has to be sent, to compensate for the distance.
The value for the Timing Advance is determined by the \gls{bsc} after receiving a channel request message from the mobile station and afterwards constantly updated by the respective \gls{bts}.
-
The different Burst types are:
\begin{itemize}
\item Normal Burst: The basic information transmitting Burst.
All information on traffic and control channels is transmitted by this Burst except for the \gls{rach}.
- Furthermore this Burst contains \glspl{sf}.
- If these are set the Burst contains important signalling data that has to travel fast over the \gls{facch} however no normal data can be transmitted in this case.
+ Furthermore, this Burst contains \glspl{sf}.
+ If these are set, the Burst contains important signalling data that has to travel fast over the \gls{facch}, however, no normal data can be transmitted in this case.
\item Frequency Correction Burst: This Burst is sent frequently and is used by \glspl{ms} to fine tune to the frequency of the \gls{bts}.
It may also be used by the \gls{ms} to do time synchronisation for \gls{tdma} frames.
- The periodic broadcasting of this frame is also called \gls{fcch} and shares a frequency with the \gls{bcch} as will be shown in the next section.
- \item Synchronisation Burst: This Burst contains time synchronisation information from the \gls{bts} to the \gls{ms} as well as the running \gls{tdma} frame number.
+ The periodic broadcasting of this Burst forms the \gls{fcch} and shares a frequency with the \gls{bcch} as will be shown in the next section.
+ \item Synchronisation Burst: This Burst contains time synchronisation information from the \gls{bts} for the \gls{ms} as well as the running \gls{tdma} frame number.
Periodic broadcasting of this Burst forms the \gls{sch}.
- \item Dummy Burst: When no other Bursts are sent on the frequency carrying the \gls{bcch} this one is transmitted to fill the gap.
+ \item Dummy Burst: When no other Bursts are sent on the frequency carrying the \gls{bcch}, this one is transmitted to fill the gap.
This way the \gls{ms} can keep up doing quality measurements even if no data needs to be transmitted.
\item Access Burst: The Burst that is used to transmit data on the \gls{rach}.
- Since everyone can sent on the \gls{rach} without being given a timeslot via Slotted Aloha\footnote{Slotted Aloha is a medium access procedure in which each participant can send data in predefined timeslots. If collisions occur the data is discarded and each participant has to wait a random time interval before sending again.} procedure the guard times of this Burst are high as to reduce the probability of data collisions.
+ Since everyone can sent on the \gls{rach} without being given a timeslot via Slotted Aloha\footnote{Slotted Aloha is a medium access procedure in which each participant can send data in predefined timeslots. If collisions occur the data is discarded and each participant has to wait a random time interval before sending again.} procedure, the guard times of this Burst are high as to reduce the probability of data collisions.
\end{itemize}
-The information in this section described the physical properties of the Air Interface also called Layer 1 when referring to the standard ISO\,/\,OSI model.
+
+The information in this section described the physical properties of the Air Interface. also called Layer 1 when referring to the standard ISO\,/\,OSI model.
A short description of the other layers will be presented in Section \ref{sec:layers}.
\subsection{Logical Channels}
\label{sec:channels}
A logical channel is a virtual construct on top of the physical construct of frames to group similar information together.
-Since not all information has to be sent all the time these different information channels, \eg broadcast information about the respective base station, can be multiplexed and sent together.
+Since not all information has to be sent all the time, these different information channels, \eg broadcast information about the respective base station, can be multiplexed and sent together.
\begin{figure}
\centering
\includegraphics{../Images/Channels}
@@ -622,7 +629,7 @@ Figure \ref{fig:channels} shows this mapping of channels onto time slots over th
This way each timeslot over the course of multiple frames can be regarded as a virtual channel.
These resulting virtual channels can now be used by a multitude of logical channels to transmit information.
-There are two main categories of logical channels distinguished by their usage \cite{kommsys2006}, dedicated channels and common channels.
+There are two main categories of logical channels, distinguished by their usage \cite{kommsys2006}, dedicated channels and common channels.
Dedicated channels transport data meant for a single subscriber whereas common channels contain information interesting to all subscribers.
\subsubsection{Dedicated Channels}
@@ -631,7 +638,7 @@ These are point to point channels.
\begin{itemize}
\item \gls{tch}: A data channels that is used to transmit voice data or data service packages.
\item \gls{facch}: A channel for transmission of urgent signalling data, \eg Handover signalling.
- This data doesn't have to be send often it shares a timeslot with the \gls{tch} and uses the stealing flags to insert its own data.
+ This data doesn't have to be send often, so it shares a timeslot with the \gls{tch} and uses the stealing flags to insert its own data.
\item \gls{sacch}: The uplink of this channel is used by the \gls{ms} to transmit quality measurements of the cell and neighbouring cells to the base station, so the network can do Handover decisions accordingly.
The downlink is used for Timing Advance data and power management data for the \gls{ms}.
\item \gls{sdcch}: On this channel signalling information is sent to a subscriber as long as no \gls{tch} has been assigned during the initialisation of a call.
@@ -641,20 +648,20 @@ These are point to point channels.
\subsubsection{Common Channels}
\label{sec:common_channels}
The common channels contain data interesting to all subscribers, thus having a broadcast nature.
-This channels are the main source of information gathered by the \gls{icds}.
-These are point to multi-point channels.
+These channels are the main source of information gathered by the \gls{icds}.
+They are point to multi-point channels.
\begin{itemize}
\item \gls{sch}: When the \gls{ms} is looking for a cell to connect, this synchronisation channel is used.
- \item \gls{fcch}: Used by \glspl{ms} to fine tune to the frequency of a certain base station and helps to find the start of a 51-Multiframe.
+ \item \gls{fcch}: It is used by \glspl{ms} to fine tune to the frequency of a certain base station and helps to find the start of a 51-Multiframe.
\item \gls{bcch}: This channel is used to transmit information about the network and the base station itself through different \emph{System Information Messages}.
These contain the network name and cell identification as well as neighbourhood information on cells in the area and much more.
- This channel will be the main source of information for this project since it allows harvesting information without actively participating in the network and will thus be discussed in further detail in Chapter \ref{sec:info_gathering}.
+ This channel will be the main source of information for this project, since it allows harvesting information without actively participating in the network and will thus be discussed in further detail in Chapter \ref{sec:info_gathering}.
\item \gls{pch}: If a subscriber is not assigned a dedicated channel yet, \ie he\,/\,she is not active, they are notified on this channel if there is an incoming call or text.
- The subscribers are identified by their \gls{tmsi} which has been previously assigned upon entering the network so the \gls{imsi} does not have to be broadcasted.
+ The subscribers are identified by their \gls{tmsi} which has been previously assigned upon entering the network.
This channel will be used as an additional source of information for the \gls{icds}.
\item \gls{rach}: A subscriber that has been notified over the \gls{pch} can contact the network and request a \gls{sdcch}.
Since this is a channel used by all connected and idle \glspl{ms}, access has to be regulated.
- As the name implies access is random thus it can happen that two or more \gls{ms} try to send at the same time.
+ As the name implies, access is random thus it can happen that two or more \gls{ms} try to send at the same time.
Slotted Aloha is used to handle access.
\item \gls{agch}: This is the channel used to respond to a \gls{ms} if a request has been made on the \gls{rach}.
The acknowledgement message also contains information on which \gls{sdcch} to use.
@@ -665,37 +672,37 @@ These channels cannot arbitrarily be mapped onto Multiframes.
There is a complex multiplexing scheme defined in GSM 05.02 \cite{gsm0502} that explains which channel combinations can occur inside a Multiframe.
A table containing the possible combinations can be found in Appendix \ref{sec:combinations}.
The mapping of these specific Multiframe-configurations onto timeslots is not arbitrary either.
-Normally TS-0 and TS-1, the first two time slots, are used handle channels with signalling information.
+Normally TS-0 and TS-1, the first two time slots, are used to handle channels with signalling information.
The \gls{bcch} for example, which we will use to harvest information uses TS-0 on the carrier frequency.
\subsection{Layers}
\label{sec:layers}
-Design-wise the layers of the $U_m$ interface resemble the layers of the ISO\,/\,OSI reference model specified by the \gls{itu}.
-This section will give a short overview over the first three layers with respect to the air interface \cite{protocols1999} since these are the ones that the employed framework works on.
+Design-wise the layers of the $U_m$ interface resemble the layers of the ISO\,/\,OSI reference model.
+This section will give a short overview over the first three layers with respect to the air interface \cite{protocols1999}, since these are the ones that the employed framework works on.
\paragraph{Physical Layer (Layer 1):} This layer provides the facilities for the actual transmission of data.
-In case of the $U_m$ interface this is the actual radio equipment.
-This layer does not know data types like user or signalling data.
-The data that it receives from Layer 2 are either single bits or an array of bits.
-On the algorithmic side of Layer 1 the \gls{gmsk} modulation is used to encode the data a Burst contains into radio signals.
+In case of the $U_m$ interface, this is the actual radio equipment.
+On this layer no differentiation between data types like user or signalling data is done.
+The data that it receives from Layer 2 is either single bit data or an arrays of bits.
+\gls{gmsk} modulation is used to encode the data a Burst contains into radio signals.
\paragraph{Data Link (Layer 2):} On Layer 2 packaging is done.
The notion of data frames is introduced to have chunks of information on which error checking and potential retransmission of corrupted data can be performed.
The Layer 2 protocol \gls{hdlc} is used as a basis for \gls{ss7} as well as for \gls{lapd}, which are the basic protocols a classical telephone network operates upon.
\gls{hdlc} and its derivatives use start\,/\,stop markers and checksums to form data frames.
The Layer 2 format changes through the course of the network while the data packages of Layer 3 may stay the same.
-When a transmission from a \gls{ms} to the \gls{bts} is done \gls{lapdm} is used which is essentially the same as the Layer 2 \gls{isdn} protocol with a few simplifications.
-From the \gls{bts} to the \gls{bsc} \gls{lapdm} converts to \gls{lapd} and afterwards is exchanged to \gls{mtp2}.
-For the air interface \gls{lapdm} along with channel coding and Burst formatting form Layer 2.
+When a transmission from a \gls{ms} to the \gls{bts} is done, \gls{lapdm} is used, which is essentially the same as the Layer 2 \gls{isdn} protocol with a few simplifications.
+From the \gls{bts} to the \gls{bsc}, \gls{lapdm} converts to \gls{lapd} and afterwards is exchanged to \gls{mtp2}.
+For the air interface \gls{lapdm}, along with channel coding and Burst formatting form Layer 2.
More information about these Layer 2 protocols can be found in the respective Technical Specifications of the \gls{3gpp} \cite{GSM0405,GSM0406}.
\paragraph{Network (Layer 3):} Layer 3 headers have to provide all the information necessary for the packet to be routed towards its recipient.
-As with Layer 2 information it may be the case that this header needs to be partially rewritten during the transmission of a package.
+As with Layer 2 information, it may be the case that this header needs to be partially rewritten during the transmission of a package.
Between the \gls{ms}, \gls{bts}, \gls{bsc} and \gls{msc} the \gls{rr} protocol and the information needed to route a call into the \gls{ss7} subsystem are part of Layer 3.
This protocol handles configuration and allocation of radio channels as well as managing the dedicated channels to the subscribers.
Therefore in a strict sense \gls{mm} and \gls{cc} information does not belong to Layer 3 functionality but is only transported via \gls{rr} between \gls{ms} and the \gls{nss} \cite{protocols1999}.
-\section{IMSI-Catcher}
+\section{IMSI Catcher}
\label{sec:catcher}
An IMSI catcher is a device that is used to capture the \gls{imsi} and \gls{imei} numbers of mobile subscribers.
The knowledge of the \gls{imsi} and \gls{imei} numbers can be exploited to either tap into the participant's calls or pinpoint the location of the subscriber \cite{fox}.
diff --git a/Tex/Content/Motivation.tex b/Tex/Content/Motivation.tex
index c46b5a3..95462f2 100644
--- a/Tex/Content/Motivation.tex
+++ b/Tex/Content/Motivation.tex
@@ -3,45 +3,47 @@
\section{Motivation}
Boundless communication for everyone, everywhere, any time.
That was the main idea and dream behind the development of the \gls{gsm} technology.
-Considering its reception and growth it can be said that \gls{gsm} was one of the most successful technologies of the last 30 years \cite{GSM2009,GSM_history2011,GSM_stats2011}.
+Considering its reception and growth it can be said that \gls{gsm} was one of the most successful technologies of the last 30 years \cite{GSM2009,GSM_history2011,GSM_stats2011}.
The advent of portable radio equipment and microprocessors in the 1980's made mobile phones technologically possible.
From that point on commercialisation started with more and more providers emerging.
-With more users, security became an ever more important aspect since confidential telephone calls were now made over radio instead of fixed landlines.
-This is an inherent problem of the medium, anybody with suitable equipment can access radio waves while whit landlines physical access was required.
-In 1996 a device was released that took advantage of a security hole in the \gls{gsm} protocol which enabled it to record phone calls and track users \cite{fox}.
-This device was developed by Rhode\,\&\,Schwarz and was called IMSI catcher.
-The name refers to the IMSI number, a unique identification of the user inside the \gls{gsm} network.
-It can be obtained by the device by impersonating a base station which is the entry point of the subscriber to the network.
-By means of a classical man-in-the-middle attack the IMSI catcher lures the subscriber to connect to it and relay the information to a real base station while harvesting the needed information like calls or IMSI numbers invisibly.
-The mobile phone used by the subscriber cannot distinguish between a regular base station and an IMSI catcher and will always connect to the strongest base station available.
+With more users, security became an ever more important aspect, since confidential telephone calls were now made over radio instead of fixed landlines.
+An inherent problem of the air medium is that anybody with suitable equipment can access radio waves, while with landlines physical access is required.
+In 1996 Rhode\,\&\,Schwarz released the IMSI catcher \cite{fox}, a device that takes advantage of security flaws in the \gls{gsm} protocol which enables it to record phone calls and track users.
+The name refers to the \gls{imsi} number, a unique identification of the user inside the \gls{gsm} network.
+It can be obtained by the device by impersonating a base station which is the entry point of the subscriber into the network.
+To the mobile phone used by the subscriber there is no difference between a real base station and an IMSI catcher.
+It will always connect to the strongest base station available.
+By means of a classical man-in-the-middle attack the IMSI catcher operator lures the subscriber to connect to the device and relays the information to a legitimate base station while harvesting the desired information, like calls or \gls{imsi} numbers.
+This process is completely invisible to the user.
-This risk is intensified by the fact that several other projects like the Open Source IMSI-Catcher \cite{dennis} succeeded in building such an IMSI catcher at a very low cost, using hardware and software that is freely available.
-Basically it is now possible for anyone, be it a jealous spouse or a private investigator, to self-construct these devices in an cost-effective manner.
+
+Up until now countermeasures to IMSI catchers have not been given much attention to, since the commercial grade devices were only available to authorities and private abuse was thus not a important issue.
+This risk is intensified by the fact that several other projects like the Open Source IMSI-Catcher \cite{dennis} demonstrated that such an IMSI catcher can be built at very low cost, using hardware and software that is freely available.
+It is now possible for anyone to self-construct these devices in an cost-effective manner.
With these systems it is considerably easier to eavesdrop on and thus breach the privacy of a neighbour, wife or husband.
-Corporate phone calls are also easier to target this way in the context of industrial espionage if done over a mobile phone.
+In the context of industrial espionage, corporate phone calls done over a mobile phone are also easier to target this way.
-Up until now countermeasures to IMSI catchers have not been given much attention to since the commercial grade devices were only available to authorities and private abuse was thus not a large issue.
-This is where this project is aimed at.
-In this project different ways will be explored on how to identify an IMSI catcher based on its differences to a regular base station.
-Additionally information of the surrounding area and tracking of different parameters over time is used to isolate suspicious base stations in the perimeter.
-We develop a toolbox that makes it possible to gather and analyse information from all available base stations in an easy manner, the \gls{icds}.
-It is also designed to operate in an end user mode where only a very simplified version of the GUI is presented and an evaluation is yielded of whether it is safe to place a phone call or not.
-The tool operates in a completely passive manner, only on information that is freely broadcasted, never connecting to base stations in question.
-This way the system itself stays invisible to the base stations and thus potential IMSI catchers while evaluating them.
+The detection of illegal private use of IMSI catchers is where this project is aimed at.
+Different ways will be explored on how to identify an IMSI catcher based on its differences to a regular base station.
+In particular, information about the surrounding area and tracking of different parameters over time is used to isolate suspicious base stations in the perimeter.
+We present a tool that makes it possible to gather and analyse information from all available base stations in an easy manner, using a sophisticated graphical interface: the \gls{icds}.
+It also allows switch to an end user mode, where only a very simplified version of the graphical interface is presented and the program evaluates whether it is safe to place a phone call or not.
+The tool operates in a passive manner, \ie it only uses information that is freely broadcasted, never connecting to base stations in question.
+This way the system itself stays invisible to base stations and thus potential IMSI catchers while evaluating them.
\section{Structure}
The remainder of this thesis is structured as follows: the second chapter will give an overview of how a \gls{gsm} network is built up to create a general understanding of the infrastructure in which an IMSI catcher and the detection system are situated.
-Protocol specifics of the interface on which the two systems operate, the interface between a mobile phone and the base station will be discussed in the second part.
-The chapter concludes with a description of how an IMSI catcher works and gives an account of what kind of attacks are possible.
+Protocol specifics of the interface on which the two systems operate, the $U_m$ or air interface will be discussed in the second part.
+The chapter concludes with a description of how an IMSI catcher works and gives an account of what kinds of attacks are possible.
In the third chapter, the software framework and hardware is introduced on which the \gls{icds} is built upon.
The different procedures used for information gathering and evaluation are also discussed in this chapter based on possible attacks an IMSI catcher can perform as well as the differences in parameters to a valid base station.
Finally a explanation of how to set up and operate the system together with some use cases is outlined.
The fourth chapter contains an evaluation of how the system performs in several categories.
-First some general performance statistics and results on the individual methods used are collected.
-Afterwards a longer test is conducted over the course of one week to see how well the databases the system uses work in a potentially changing environment.
+First, some general performance statistics and results on the individual methods used are collected.
+Afterwards, a longer test is conducted over the course of one week to see how well the databases the system uses work in a potentially changing environment.
The chapter ends with two simulated attack scenarios.
In the last chapter, a short summary of the results will be given as well as an outlook of how the system can be extended in several ways.
@@ -50,12 +52,13 @@ In the last chapter, a short summary of the results will be given as well as an
While conducting the practical part of this thesis precautions have been taken not to interrupt or influence radio transmissions made by regular subscribers.
The main part of the experiments is passive information gathering which only harvests information that is freely available and thus does not influence regular communication procedures.
-The IMSI catcher was configured in a way to not let subscribers connect, therefore it is not interfering with regular connection procedures.
-Operation of the IMSI catcher was restricted to the ARFCN 877 which is officially registered to the university.
+Whenever the IMSI catcher was used, it was configured in a way to not let subscribers connect.
+Therefore, it is not interfering with regular connection procedures.
+Operation of the IMSI catcher and the OpenBTS base station were restricted to ARFCN 877 which is officially registered to the university.
\section{On Typesetting}
-To make the thesis more readable a few conventions will be kept throughout this document.
-Important words or components of the \gls{icds} are printed \emph{emphasised}.
+To make the thesis more readable, a few conventions will be kept throughout this document.
+Important words or components of the \gls{icds} are printed \emph{emphasised} when they first appear.
\texttt{Type\-writer} is used whenever a program or a file name are used in the running text.
Code examples can be distinguished by a code listing box that surrounds them.\\\\
\hspace*{\dimexpr\fboxsep+\fboxrule}%
diff --git a/Tex/Master/Glossary.tex b/Tex/Master/Glossary.tex
index edd3b15..88a74fc 100644
--- a/Tex/Master/Glossary.tex
+++ b/Tex/Master/Glossary.tex
@@ -51,7 +51,7 @@
\newacronym{hlr}{HLR}{Home Location Register}
\newacronym{vlr}{VLR}{Visitor Location Register}
\newacronym{eir}{EIR}{Equipment Identity Register}
-\newacronym{ac}{AC}{Authentication Center}
+\newacronym{ac}{AuC}{Authentication Center}
\newacronym{smsc}{SMSC}{Short Message Service Center}
\newacronym{msisdn}{MSISDN}{Mobile Subscriber Integrated Services Digital Network Number}
\newacronym{msrn}{MSRN}{Mobile Station Roaming Number}
@@ -61,7 +61,7 @@
\newacronym{cc}{CC}{Call Control}
\newacronym{isdn}{ISDN}{Integrated Services Digital Network}
\newacronym{bsc}{BSC}{Base Station Controller}
-\newacronym{bts}{BTS}{Base Station Transceiver}
+\newacronym{bts}{BTS}{Base Transceiver Station}
\newacronym{trau}{TRAU}{Transcoding Rate and Adaption Unit}
\newacronym{arfcn}{ARFCN}{Absolute Radio Frequency Number}
\newacronym[firstplural=Cell Identities (CIDs)]{cid}{CID}{Cell Identity}
diff --git a/Tex/Master/Master.acn b/Tex/Master/Master.acn
index 23d6b26..4614b58 100644
--- a/Tex/Master/Master.acn
+++ b/Tex/Master/Master.acn
@@ -1,7 +1,9 @@
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{1}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{1}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{1}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{1}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{1}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{1}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{2}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{2}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{2}
@@ -88,7 +90,7 @@
\glossaryentry{MCC?\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }|setentrycounter{page}\glsnumberformat}{10}
\glossaryentry{MNC?\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }|setentrycounter{page}\glsnumberformat}{10}
\glossaryentry{MSIN?\glossaryentryfield{msin}{\glsnamefont{MSIN}}{Mobile Subscriber Identification Number}{\relax }|setentrycounter{page}\glsnumberformat}{10}
-\glossaryentry{HNI?\glossaryentryfield{hni}{\glsnamefont{HNI}}{Home Network Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{HNI?\glossaryentryfield{hni}{\glsnamefont{HNI}}{Home Network Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{10}
\glossaryentry{MCC?\glossaryentryfield{mcc}{\glsnamefont{MCC}}{Mobile Country Code}{\relax }|setentrycounter{page}\glsnumberformat}{11}
\glossaryentry{MNC?\glossaryentryfield{mnc}{\glsnamefont{MNC}}{Mobile Network Code}{\relax }|setentrycounter{page}\glsnumberformat}{11}
\glossaryentry{PLMN?\glossaryentryfield{plmn}{\glsnamefont{PLMN}}{Public Land Mobile Network}{\relax }|setentrycounter{page}\glsnumberformat}{11}
@@ -106,14 +108,14 @@
\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{11}
\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{11}
\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{11}
-\glossaryentry{AC?\glossaryentryfield{ac}{\glsnamefont{AC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{11}
\glossaryentry{EIR?\glossaryentryfield{eir}{\glsnamefont{EIR}}{Equipment Identity Register}{\relax }|setentrycounter{page}\glsnumberformat}{11}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{11}
\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{11}
\glossaryentry{NSS?\glossaryentryfield{nss}{\glsnamefont{NSS}}{Network Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{11}
\glossaryentry{ISDN?\glossaryentryfield{isdn}{\glsnamefont{ISDN}}{Integrated Services Digital Network}{\relax }|setentrycounter{page}\glsnumberformat}{11}
-\glossaryentry{PLMN?\glossaryentryfield{plmn}{\glsnamefont{PLMN}}{Public Land Mobile Network}{\relax }|setentrycounter{page}\glsnumberformat}{12}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{12}
+\glossaryentry{PLMN?\glossaryentryfield{plmn}{\glsnamefont{PLMN}}{Public Land Mobile Network}{\relax }|setentrycounter{page}\glsnumberformat}{11}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{11}
\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{12}
\glossaryentry{CC?\glossaryentryfield{cc}{\glsnamefont{CC}}{Call Control}{\relax }|setentrycounter{page}\glsnumberformat}{12}
\glossaryentry{MM?\glossaryentryfield{mm}{\glsnamefont{MM}}{Mobility Management}{\relax }|setentrycounter{page}\glsnumberformat}{12}
@@ -150,27 +152,27 @@
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{13}
\glossaryentry{VLR?\glossaryentryfield{vlr}{\glsnamefont{VLR}}{Visitor Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{13}
\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{13}
-\glossaryentry{AC?\glossaryentryfield{ac}{\glsnamefont{AC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{HLR?\glossaryentryfield{hlr}{\glsnamefont{HLR}}{Home Location Register}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{14}
-\glossaryentry{AC?\glossaryentryfield{ac}{\glsnamefont{AC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
-\glossaryentry{AC?\glossaryentryfield{ac}{\glsnamefont{AC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
-\glossaryentry{AC?\glossaryentryfield{ac}{\glsnamefont{AC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{Ki?\glossaryentryfield{ki}{\glsnamefont{Ki}}{Secret Key}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
-\glossaryentry{AC?\glossaryentryfield{ac}{\glsnamefont{AC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
+\glossaryentry{AuC?\glossaryentryfield{ac}{\glsnamefont{AuC}}{Authentication Center}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter{page}\glsnumberformat}{14}
\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter{page}\glsnumberformat}{15}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{15}
@@ -178,47 +180,47 @@
\glossaryentry{BSS?\glossaryentryfield{bss}{\glsnamefont{BSS}}{Basestation Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{15}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{15}
\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{15}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{15}
\glossaryentry{TRAU?\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }|setentrycounter{page}\glsnumberformat}{15}
\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{15}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{15}
\glossaryentry{TRAU?\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }|setentrycounter{page}\glsnumberformat}{15}
\glossaryentry{TRAU?\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }|setentrycounter{page}\glsnumberformat}{15}
\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{15}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{15}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{15}
\glossaryentry{TRAU?\glossaryentryfield{trau}{\glsnamefont{TRAU}}{Transcoding Rate and Adaption Unit}{\relax }|setentrycounter{page}\glsnumberformat}{15}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{15}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{16}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{16}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{16}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{16}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{16}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{16}
\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{16}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{17}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{17}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{17}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{17}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{17}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{17}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{17}
\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{18}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{18}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{18}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{18}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{18}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{BSS?\glossaryentryfield{bss}{\glsnamefont{BSS}}{Basestation Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{18}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{BSS?\glossaryentryfield{bss}{\glsnamefont{BSS}}{Basestation Subsystem}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{18}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{18}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{AGCH?\glossaryentryfield{agch}{\glsnamefont{AGCH}}{Access Grand Channel}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
@@ -231,8 +233,8 @@
\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{18}
-\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{18}
+\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{18}
\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{19}
\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{19}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{19}
@@ -247,21 +249,21 @@
\glossaryentry{Kc?\glossaryentryfield{kc}{\glsnamefont{Kc}}{Ciphering Key}{\relax }|setentrycounter{page}\glsnumberformat}{19}
\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{19}
\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{19}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{19}
\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{19}
+\glossaryentry{FACCH?\glossaryentryfield{facch}{\glsnamefont{FACCH}}{Fast Access Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{19}
\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{20}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{20}
-\glossaryentry{FACCH?\glossaryentryfield{facch}{\glsnamefont{FACCH}}{Fast Access Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{20}
-\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{20}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{20}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{20}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{20}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{20}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{20}
\glossaryentry{FDMA?\glossaryentryfield{fdma}{\glsnamefont{FDMA}}{Frequency Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{20}
\glossaryentry{FDMA?\glossaryentryfield{fdma}{\glsnamefont{FDMA}}{Frequency Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{20}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{20}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{20}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{20}
\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{20}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{20}
\glossaryentry{FDMA?\glossaryentryfield{fdma}{\glsnamefont{FDMA}}{Frequency Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{20}
@@ -270,30 +272,30 @@
\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{21}
\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{21}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{21}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{21}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{21}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{21}
\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter{page}\glsnumberformat}{21}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{21}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{21}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{21}
\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{23}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{SF?\glossaryentryfield{sf}{\glsnamefont{SF}}{Stealing Flag}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{FACCH?\glossaryentryfield{facch}{\glsnamefont{FACCH}}{Fast Access Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{23}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{FCCH?\glossaryentryfield{fcch}{\glsnamefont{FCCH}}{Frequency Correction Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{23}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{23}
-\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{24}
+\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{23}
\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{24}
\glossaryentry{TDMA?\glossaryentryfield{tdma}{\glsnamefont{TDMA}}{Time Division Multiple Access}{\relax }|setentrycounter{page}\glsnumberformat}{24}
\glossaryentry{TCH?\glossaryentryfield{tch}{\glsnamefont{TCH}}{Traffic Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
@@ -311,9 +313,8 @@
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{25}
\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{25}
-\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{26}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{26}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{25}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{25}
\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
@@ -324,17 +325,16 @@
\glossaryentry{RACH?\glossaryentryfield{rach}{\glsnamefont{RACH}}{Random Access Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
\glossaryentry{SDCCH?\glossaryentryfield{sdcch}{\glsnamefont{SDCCH}}{Standalone Dedicated Control Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
-\glossaryentry{ITU?\glossaryentryfield{itu}{\glsnamefont{ITU}}{International Telecomunication Union}{\relax }|setentrycounter{page}\glsnumberformat}{26}
\glossaryentry{GMSK?\glossaryentryfield{gmsk}{\glsnamefont{GMSK}}{Gaussian Minimum Shift Keying}{\relax }|setentrycounter{page}\glsnumberformat}{26}
\glossaryentry{HDLC?\glossaryentryfield{hdlc}{\glsnamefont{HDLC}}{High Level Data Link Control}{\relax }|setentrycounter{page}\glsnumberformat}{26}
-\glossaryentry{SS-7?\glossaryentryfield{ss7}{\glsnamefont{SS-7}}{Signaling System 7}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{LAPD?\glossaryentryfield{lapd}{\glsnamefont{LAPD}}{Link Access Procedure, D Channel}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{HDLC?\glossaryentryfield{hdlc}{\glsnamefont{HDLC}}{High Level Data Link Control}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{SS-7?\glossaryentryfield{ss7}{\glsnamefont{SS-7}}{Signaling System 7}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{LAPD?\glossaryentryfield{lapd}{\glsnamefont{LAPD}}{Link Access Procedure, D Channel}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{HDLC?\glossaryentryfield{hdlc}{\glsnamefont{HDLC}}{High Level Data Link Control}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{26}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{LAPD$_m$?\glossaryentryfield{lapdm}{\glsnamefont{LAPD$_m$}}{LAPD Mobile}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{ISDN?\glossaryentryfield{isdn}{\glsnamefont{ISDN}}{Integrated Services Digital Network}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{LAPD$_m$?\glossaryentryfield{lapdm}{\glsnamefont{LAPD$_m$}}{LAPD Mobile}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{LAPD?\glossaryentryfield{lapd}{\glsnamefont{LAPD}}{Link Access Procedure, D Channel}{\relax }|setentrycounter{page}\glsnumberformat}{27}
@@ -342,7 +342,7 @@
\glossaryentry{LAPD$_m$?\glossaryentryfield{lapdm}{\glsnamefont{LAPD$_m$}}{LAPD Mobile}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{3GPP?\glossaryentryfield{3gpp}{\glsnamefont{3GPP}}{Third Generation Partnership Project}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{27}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{MSC?\glossaryentryfield{msc}{\glsnamefont{MSC}}{Mobile Switching Center}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{RR?\glossaryentryfield{rr}{\glsnamefont{RR}}{Radio Resource}{\relax }|setentrycounter{page}\glsnumberformat}{27}
@@ -359,7 +359,7 @@
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{27}
-\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{28}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{27}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{28}
@@ -370,13 +370,13 @@
\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{28}
-\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{28}
\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{IMSI?\glossaryentryfield{imsi}{\glsnamefont{IMSI}}{International Mobile Subscriber Identification}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{30}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{IMEI?\glossaryentryfield{imei}{\glsnamefont{IMEI}}{International Mobile Equipment Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{30}
@@ -385,10 +385,10 @@
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{30}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
-\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{31}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{31}
@@ -398,8 +398,8 @@
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{31}
\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{31}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{31}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{31}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{31}
\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{31}
\glossaryentry{SIM?\glossaryentryfield{sim}{\glsnamefont{SIM}}{Subscriber Identity Module}{\relax }|setentrycounter{page}\glsnumberformat}{32}
@@ -411,7 +411,7 @@
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{35}
\glossaryentry{Osmocom?\glossaryentryfield{osmo}{\glsnamefont{Osmocom}}{Open source mobile communications}{\relax }|setentrycounter{page}\glsnumberformat}{35}
\glossaryentry{Osmocom?\glossaryentryfield{osmo}{\glsnamefont{Osmocom}}{Open source mobile communications}{\relax }|setentrycounter{page}\glsnumberformat}{35}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{35}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{35}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{35}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{35}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{35}
@@ -427,7 +427,7 @@
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{38}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{38}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{39}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{39}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{39}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{39}
\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{39}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{39}
@@ -435,10 +435,10 @@
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{39}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{39}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{39}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{39}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{39}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{39}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{39}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{39}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{39}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{39}
\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{39}
\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{39}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{40}
@@ -446,18 +446,18 @@
\glossaryentry{SCH?\glossaryentryfield{sch}{\glsnamefont{SCH}}{Signalling Channel}{\relax }|setentrycounter{page}\glsnumberformat}{40}
\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{40}
\glossaryentry{BSC?\glossaryentryfield{bsc}{\glsnamefont{BSC}}{Base Station Controller}{\relax }|setentrycounter{page}\glsnumberformat}{40}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{40}
\glossaryentry{TC?\glossaryentryfield{tc}{\glsnamefont{TC}}{Type Code}{\relax }|setentrycounter{page}\glsnumberformat}{40}
\glossaryentry{FN?\glossaryentryfield{fn}{\glsnamefont{FN}}{Frame Number}{\relax }|setentrycounter{page}\glsnumberformat}{40}
\glossaryentry{TC?\glossaryentryfield{tc}{\glsnamefont{TC}}{Type Code}{\relax }|setentrycounter{page}\glsnumberformat}{40}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{40}
\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{40}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{40}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{40}
\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{40}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{40}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{40}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{40}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{40}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{40}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{42}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{42}
@@ -475,7 +475,7 @@
\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{42}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{42}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{42}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{42}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{42}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{42}
\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{42}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{42}
@@ -489,27 +489,27 @@
\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{43}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{43}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{43}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{43}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{43}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{44}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{43}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{43}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{44}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{44}
\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{44}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{44}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{44}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{44}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{45}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{45}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{45}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{45}
\glossaryentry{LA?\glossaryentryfield{la}{\glsnamefont{LA}}{Location Area}{\relax }|setentrycounter{page}\glsnumberformat}{45}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{46}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{46}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{46}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{46}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{46}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{46}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{48}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{48}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{49}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{49}
\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{49}
\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{49}
\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{49}
@@ -541,7 +541,7 @@
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{52}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{52}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{52}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{52}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{52}
\glossaryentry{ME?\glossaryentryfield{me}{\glsnamefont{ME}}{Mobile Equipment}{\relax }|setentrycounter{page}\glsnumberformat}{52}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{52}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{53}
@@ -552,10 +552,10 @@
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{54}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{55}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{55}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{55}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{55}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{57}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{57}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{CSV?\glossaryentryfield{csv}{\glsnamefont{CSV}}{Comma Separated Value}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{57}
@@ -565,22 +565,22 @@
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{57}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{58}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{58}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{58}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{58}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{58}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{58}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{58}
\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{58}
\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{60}
\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{60}
\glossaryentry{LAI?\glossaryentryfield{lai}{\glsnamefont{LAI}}{Location Area Identifier}{\relax }|setentrycounter{page}\glsnumberformat}{60}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{60}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{60}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{60}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{60}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{60}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{60}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{60}
\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{60}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{61}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{61}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{61}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{61}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{61}
@@ -593,7 +593,7 @@
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{63}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{63}
\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{64}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{64}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{64}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{65}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{65}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{66}
@@ -642,7 +642,7 @@
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{71}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{71}
\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{72}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{72}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{72}
\glossaryentry{CID?\glossaryentryfield{cid}{\glsnamefont{CID}}{Cell Identity}{\relax }|setentrycounter{page}\glsnumberformat}{72}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{72}
\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{72}
@@ -657,7 +657,7 @@
\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{74}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{74}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{74}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{74}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{74}
\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{74}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{74}
\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{74}
@@ -681,7 +681,7 @@
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{77}
\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{77}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{77}
-\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{77}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Transceiver Station}{\relax }|setentrycounter{page}\glsnumberformat}{77}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{77}
\glossaryentry{TMSI?\glossaryentryfield{tmsi}{\glsnamefont{TMSI}}{Temporary IMSI}{\relax }|setentrycounter{page}\glsnumberformat}{77}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{77}
@@ -695,3 +695,12 @@
\glossaryentry{IA?\glossaryentryfield{ia}{\glsnamefont{IA}}{Immediate Assignment Message}{\relax }|setentrycounter{page}\glsnumberformat}{77}
\glossaryentry{PCH?\glossaryentryfield{pch}{\glsnamefont{PCH}}{Paging Channel}{\relax }|setentrycounter{page}\glsnumberformat}{77}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{78}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{78}
+\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter{page}\glsnumberformat}{78}
+\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter{page}\glsnumberformat}{78}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{78}
+\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter{page}\glsnumberformat}{78}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{78}
+\glossaryentry{UMTS?\glossaryentryfield{umts}{\glsnamefont{UMTS}}{Universal Mobile Telecomunications System}{\relax }|setentrycounter{page}\glsnumberformat}{78}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{78}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{78}
diff --git a/Tex/Master/Master.aux b/Tex/Master/Master.aux
index 72c5b47..5231165 100644
--- a/Tex/Master/Master.aux
+++ b/Tex/Master/Master.aux
@@ -73,20 +73,21 @@
\newlabel{sec:ms}{{2.2.1}{8}}
\citation{GSM0207}
\citation{protocols1999}
-\FN@pp@footnote@aux{3}{9}
-\FN@pp@footnote@aux{4}{9}
\citation{protocols1999}
\citation{protocols1999}
+\FN@pp@footnote@aux{3}{9}
+\FN@pp@footnote@aux{4}{9}
\citation{kommsys2006}
\citation{GSM23003}
\citation{ITU212}
-\@writefile{lot}{\contentsline {table}{\numberline {2.1}{\ignorespaces Subset of data stored on a SIM card. Adopted from \cite {protocols1999}}}{10}}
+\@writefile{lot}{\contentsline {table}{\numberline {2.1}{\ignorespaces Subset of data stored on a SIM card. Adopted \cite {protocols1999}}}{10}}
\newlabel{tab:simdata}{{2.1}{10}}
\@writefile{lot}{\contentsline {table}{\numberline {2.2}{\ignorespaces Mobile Country and Network Codes. (R) denotes that the MCC is reserved but not operational as of yet, whereas (T) denotes a operational test network.}}{11}}
\newlabel{tab:countrycodes}{{2.2}{11}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.2.2}Network Subsystem}{11}}
\newlabel{sec:nss}{{2.2.2}{11}}
\@writefile{toc}{\contentsline {subsubsection}{Mobile Switching Center}{11}}
+\citation{kommsys2006}
\@writefile{toc}{\contentsline {subsubsection}{Home Location Register}{12}}
\@writefile{lof}{\contentsline {figure}{\numberline {2.3}{\ignorespaces Authentication procedure.}}{13}}
\newlabel{fig:authentication}{{2.3}{13}}
@@ -164,7 +165,7 @@
\citation{fox}
\citation{def_catcher}
\@writefile{toc}{\contentsline {paragraph}{Network (Layer 3):}{27}}
-\@writefile{toc}{\contentsline {section}{\numberline {2.4}IMSI-Catcher}{27}}
+\@writefile{toc}{\contentsline {section}{\numberline {2.4}IMSI Catcher}{27}}
\newlabel{sec:catcher}{{2.4}{27}}
\citation{mueller}
\citation{mueller}
@@ -187,10 +188,10 @@
\citation{fox}
\@writefile{lof}{\contentsline {figure}{\numberline {2.13}{\ignorespaces Takeover attack of an IMSI catcher on a base station.}}{31}}
\newlabel{fig:takeover_attack}{{2.13}{31}}
+\@writefile{toc}{\contentsline {subsubsection}{Risks and Irregularities}{31}}
\citation{fox}
\citation{imsi_wiki}
\citation{criminal_justice}
-\@writefile{toc}{\contentsline {subsubsection}{Risks and Irregularities}{32}}
\@writefile{toc}{\contentsline {subsection}{\numberline {2.4.2}Law Situation in Germany}{32}}
\newlabel{sec:catcher_law}{{2.4.2}{32}}
\FN@pp@footnotehinttrue
@@ -364,6 +365,7 @@
\@writefile{lof}{\contentsline {figure}{\numberline {5.1}{\ignorespaces ICDS decision finding process outlined.}}{76}}
\newlabel{fig:decision_process}{{5.1}{76}}
\@writefile{toc}{\contentsline {section}{\numberline {5.2}Future Work}{77}}
+\@writefile{toc}{\contentsline {paragraph}{}{78}}
\FN@pp@footnotehinttrue
\bibstyle{acm}
\citation{*}
@@ -404,6 +406,7 @@
\bibcite{wiki_cells}{29}
\bibcite{imsi_wiki}{30}
\bibcite{blacklisting}{31}
+\bibcite{richy}{32}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
\citation{GSM2009}
@@ -479,11 +482,11 @@
\@writefile{toc}{\contentsline {section}{\numberline {E.1}Rx and LAC Change Test}{105}}
\newlabel{sec:lac_change_test}{{E.1}{105}}
\@writefile{lot}{\contentsline {table}{\numberline {E.1}{\ignorespaces Configurations used for the rx\tmspace +\thinmuskip {.1667em}/\tmspace +\thinmuskip {.1667em}LAC Change Rules test.}}{105}}
-\@writefile{toc}{\contentsline {section}{\numberline {E.2}Database Rules Test}{105}}
-\newlabel{sec:long_term_test}{{E.2}{105}}
-\FN@pp@footnotehinttrue
+\@writefile{toc}{\contentsline {section}{\numberline {E.2}Database Rules Test}{106}}
+\newlabel{sec:long_term_test}{{E.2}{106}}
\@writefile{lot}{\contentsline {table}{\numberline {E.2}{\ignorespaces Configurations used for the Database Rules test.}}{106}}
\FN@pp@footnotehinttrue
+\FN@pp@footnotehinttrue
\@writefile{toc}{\contentsline {chapter}{Acronyms}{107}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
diff --git a/Tex/Master/Master.bbl b/Tex/Master/Master.bbl
index b00fb6e..e0d658b 100644
--- a/Tex/Master/Master.bbl
+++ b/Tex/Master/Master.bbl
@@ -197,4 +197,10 @@
\url{http://en.wikipedia.org/wiki/Central_Equipment_Identity_Register},
[Online; Accessed 06.2012].
+\bibitem{richy}
+{\sc Zahoransky, R.}
+\newblock {Localization in GSM Mobile Radio Networks }.
+\newblock \emph{Master Thesis at the Chair of Communication Systems at Freiburg
+ University}, November 2011.
+
\end{thebibliography}
diff --git a/Tex/Master/Master.blg b/Tex/Master/Master.blg
index d53ac52..3a5e0c3 100644
--- a/Tex/Master/Master.blg
+++ b/Tex/Master/Master.blg
@@ -2,47 +2,46 @@ This is BibTeX, Version 0.99c (TeX Live 2009/Debian)
The top-level auxiliary file: Master.aux
The style file: acm.bst
Database file #1: ../Content/Bibliography.bib
-Warning--I didn't find a database entry for "syinfos"
Warning--can't use both author and editor fields in GSM2009
-You've used 31 entries,
+You've used 32 entries,
2253 wiz_defined-function locations,
- 693 strings with 8872 characters,
-and the built_in function-call counts, 7427 in all, are:
-= -- 699
-> -- 255
+ 695 strings with 8933 characters,
+and the built_in function-call counts, 7643 in all, are:
+= -- 719
+> -- 262
< -- 0
-+ -- 107
-- -- 76
-* -- 396
-:= -- 1212
-add.period$ -- 93
-call.type$ -- 31
-change.case$ -- 127
++ -- 110
+- -- 78
+* -- 406
+:= -- 1247
+add.period$ -- 96
+call.type$ -- 32
+change.case$ -- 131
chr.to.int$ -- 0
-cite$ -- 32
-duplicate$ -- 283
-empty$ -- 746
-format.name$ -- 76
-if$ -- 1596
+cite$ -- 33
+duplicate$ -- 291
+empty$ -- 769
+format.name$ -- 78
+if$ -- 1643
int.to.chr$ -- 0
-int.to.str$ -- 31
+int.to.str$ -- 32
missing$ -- 11
-newline$ -- 158
-num.names$ -- 64
-pop$ -- 227
+newline$ -- 163
+num.names$ -- 66
+pop$ -- 235
preamble$ -- 1
-purify$ -- 99
+purify$ -- 102
quote$ -- 0
-skip$ -- 218
+skip$ -- 225
stack$ -- 0
-substring$ -- 278
-swap$ -- 71
+substring$ -- 283
+swap$ -- 73
text.length$ -- 0
text.prefix$ -- 0
top$ -- 0
-type$ -- 118
+type$ -- 122
warning$ -- 1
-while$ -- 74
-width$ -- 33
-write$ -- 314
-(There were 2 warnings)
+while$ -- 76
+width$ -- 34
+write$ -- 324
+(There was 1 warning)
diff --git a/Tex/Master/Master.ist b/Tex/Master/Master.ist
index b111f6b..e05a164 100644
--- a/Tex/Master/Master.ist
+++ b/Tex/Master/Master.ist
@@ -1,5 +1,5 @@
% makeindex style file created by the glossaries package
-% for document 'Master' on 2012-6-10
+% for document 'Master' on 2012-6-11
actual '?'
encap '|'
level '!'
diff --git a/Tex/Master/Master.log b/Tex/Master/Master.log
index 1d77bca..c5282c9 100644
--- a/Tex/Master/Master.log
+++ b/Tex/Master/Master.log
@@ -1,4 +1,4 @@
-This is pdfTeX, Version 3.1415926-1.40.10 (TeX Live 2009/Debian) (format=pdflatex 2012.1.7) 10 JUN 2012 18:18
+This is pdfTeX, Version 3.1415926-1.40.10 (TeX Live 2009/Debian) (format=pdflatex 2012.1.7) 11 JUN 2012 01:24
entering extended mode
%&-line parsing enabled.
**Master.tex
@@ -1040,69 +1040,158 @@ Underfull \hbox (badness 10000) in paragraph at lines 1--5
) [1] (../Content/Abstract.tex
LaTeX Font Info: Font shape `T1/ptm/bx/n' in size <10.95> not available
(Font) Font shape `T1/ptm/b/n' tried instead on input line 2.
+ [2
+]
(/usr/share/texmf-texlive/tex/latex/ucs/data/uni-0.def
File: uni-0.def 2004/10/17 UCS: Unicode data U+0000..U+00FF
-) [2
-
-]) [3]
+)) [3]
(../Content/Acknowledgements.tex) [4
-] [5
+] (../Content/Dedication.tex) [5
+
+] [6
+
-] (../Content/Dedication.tex) [6]
-LaTeX Font Info: Try loading font information for T1+phv on input line 143.
+
+
+]
+LaTeX Font Info: Try loading font information for T1+phv on input line 140.
(/usr/share/texmf-texlive/tex/latex/psnfss/t1phv.fd
File: t1phv.fd 2001/06/04 scalable font definitions for T1/phv.
)
LaTeX Font Info: Font shape `T1/phv/bx/n' in size <10.95> not available
-(Font) Font shape `T1/phv/b/n' tried instead on input line 143.
- (./Master.toc
-Class scrbook Info: You've told me to use the font selection of the element
-(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 2.
-Class scrbook Info: You've told me to use the font selection of the element
-(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 7.
-Class scrbook Info: You've told me to use the font selection of the element
-(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 39.
+(Font) Font shape `T1/phv/b/n' tried instead on input line 140.
+ (./Master.toc)
+\tf@toc=\write8
+\openout8 = `Master.toc'.
+
[7
+]
+[8
+
+
+
+] (../Content/Motivation.tex
+Chapter 1.
+
+Class scrbook Warning: \float@addtolists detected!
+(scrbook) You should use the features of package `tocbasic'
+(scrbook) instead of \float@addtolists.
+(scrbook) Support for \float@addtolists may be removed from
+(scrbook) `scrbook' soon .
+
+LaTeX Font Info: Font shape `T1/ptm/bx/n' in size <14.4> not available
+(Font) Font shape `T1/ptm/b/n' tried instead on input line 3.
+
+LaTeX Warning: Citation `GSM2009' on page 1 undefined on input line 6.
+
+
+LaTeX Warning: Citation `GSM_history2011' on page 1 undefined on input line 6.
+
+
+LaTeX Warning: Citation `GSM_stats2011' on page 1 undefined on input line 6.
+
+
+LaTeX Warning: Citation `fox' on page 1 undefined on input line 12.
+
+
+LaTeX Warning: Citation `dennis' on page 1 undefined on input line 22.
+
+[1
+
+
+] [2]
+LaTeX Font Info: Try loading font information for T1+pcr on input line 62.
+ (/usr/share/texmf-texlive/tex/latex/psnfss/t1pcr.fd
+File: t1pcr.fd 2001/06/04 font definitions for T1/pcr.
+)
+LaTeX Font Info: Font shape `T1/pcr/bx/n' in size <10.95> not available
+(Font) Font shape `T1/pcr/b/n' tried instead on input line 67.
+
+Underfull \hbox (badness 10000) in paragraph at lines 60--72
+ []
+) (../Content/GSM_short.tex [3] [4
]
-Class scrbook Info: You've told me to use the font selection of the element
-(scrbook) `sectioning' that is an alias of element `disposition'
+Chapter 2.
+
+LaTeX Warning: Reference `sec:network' on page 5 undefined on input line 5.
+
+
+LaTeX Warning: Reference `sec:Um' on page 5 undefined on input line 6.
+
+
+LaTeX Warning: Reference `sec:catcher' on page 5 undefined on input line 7.
+
+[5]
+
+LaTeX Warning: Citation `GSM2009' on page 6 undefined on input line 28.
+
+
+LaTeX Warning: Reference `fig:gsm_growth' on page 6 undefined on input line 30.
+
+
+
+LaTeX Warning: Citation `protocols1999' on page 6 undefined on input line 31.
+
+LaTeX Font Info: Try loading font information for OMS+ptm on input line 33.
+(/usr/share/texmf-texlive/tex/latex/psnfss/omsptm.fd
+File: omsptm.fd
+)
+LaTeX Font Info: Font shape `OMS/ptm/m/n' in size <10.95> not available
+(Font) Font shape `OMS/cmsy/m/n' tried instead on input line 33.
+
+
+LaTeX Warning: Citation `GSM2009' on page 6 undefined on input line 63.
+
+
+LaTeX Warning: Citation `GSM_history2011' on page 6 undefined on input line 63.
+
+
+
+LaTeX Warning: Citation `GSM_stats2011' on page 6 undefined on input line 63.
+
+
+LaTeX Warning: Citation `GSM2009' on page 6 undefined on input line 63.
+
+
+LaTeX Warning: Citation `GSM_history2011' on page 6 undefined on input line 63.
+
+
+
+Laning' that is an alias of element `disposition'
(scrbook) on input line 66.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
(scrbook) on input line 80.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 83.
-Class scrbook Info: You've told me to use the font selection of the element
-(scrbook) `sectioning' that is an alias of element `disposition'
(scrbook) on input line 84.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 87.
+(scrbook) on input line 85.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 91.
+(scrbook) on input line 88.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 94.
+(scrbook) on input line 92.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
(scrbook) on input line 95.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 98.
+(scrbook) on input line 96.
+Class scrbook Info: You've told me to use the font selection of the element
+(scrbook) `sectioning' that is an alias of element `disposition'
+(scrbook) on input line 99.
)
\tf@toc=\write8
\openout8 = `Master.toc'.
@@ -1126,14 +1215,14 @@ LaTeX Font Info: Font shape `T1/ptm/bx/n' in size <14.4> not available
] [2]
-LaTeX Font Info: Try loading font information for T1+pcr on input line 59.
+LaTeX Font Info: Try loading font information for T1+pcr on input line 62.
(/usr/share/texmf-texlive/tex/latex/psnfss/t1pcr.fd
File: t1pcr.fd 2001/06/04 font definitions for T1/pcr.
)
LaTeX Font Info: Font shape `T1/pcr/bx/n' in size <10.95> not available
-(Font) Font shape `T1/pcr/b/n' tried instead on input line 64.
+(Font) Font shape `T1/pcr/b/n' tried instead on input line 67.
-Underfull \hbox (badness 10000) in paragraph at lines 57--69
+Underfull \hbox (badness 10000) in paragraph at lines 60--72
[]
@@ -1150,116 +1239,112 @@ File: omsptm.fd
LaTeX Font Info: Font shape `OMS/ptm/m/n' in size <10.95> not available
(Font) Font shape `OMS/cmsy/m/n' tried instead on input line 33.
[6]
-<../Images/Architecture.png, id=70, 370.45602pt x 204.81319pt>
+<../Images/Architecture.png, id=77, 370.45602pt x 204.81319pt>
File: ../Images/Architecture.png Graphic file (type png)
<use ../Images/Architecture.png> [7]
LaTeX Font Info: Font shape `T1/ptm/bx/n' in size <12> not available
-(Font) Font shape `T1/ptm/b/n' tried instead on input line 121.
+(Font) Font shape `T1/ptm/b/n' tried instead on input line 122.
[8 <../Images/Architecture.png (PNG copy)>] [9] [10] [11]
-Underfull \vbox (badness 2285) has occurred while \output is active []
+Underfull \vbox (badness 1755) has occurred while \output is active []
[12]
-<../Images/Authentication.png, id=91, 359.1819pt x 323.0469pt>
+<../Images/Authentication.png, id=98, 359.1819pt x 323.0469pt>
File: ../Images/Authentication.png Graphic file (type png)
<use ../Images/Authentication.png>
Underfull \vbox (badness 6808) has occurred while \output is active []
[13 <../Images/Authentication.png (PNG copy)>] [14]
-<../Images/Mapping.png, id=98, 337.28409pt x 115.19838pt>
+<../Images/Mapping.png, id=106, 337.28409pt x 115.19838pt>
File: ../Images/Mapping.png Graphic file (type png)
<use ../Images/Mapping.png> [15 <../Images/Mapping.png (PNG copy)>] [16]
-<../Images/Cells.png, id=106, 98.72083pt x 88.8921pt>
+<../Images/Cells.png, id=113, 98.72083pt x 88.8921pt>
File: ../Images/Cells.png Graphic file (type png)
<use ../Images/Cells.png>
-<../Images/real_Cells.PNG, id=107, 743.02594pt x 496.10344pt>
+<../Images/real_Cells.PNG, id=114, 743.02594pt x 496.10344pt>
File: ../Images/real_Cells.PNG Graphic file (type png)
<use ../Images/real_Cells.PNG> [17 <../Images/Cells.png (PNG copy)> <../Images/
real_Cells.PNG>] [18]
-<../Images/Cipher.png, id=117, 387.72855pt x 131.02551pt>
+<../Images/Cipher.png, id=124, 387.72855pt x 131.02551pt>
File: ../Images/Cipher.png Graphic file (type png)
<use ../Images/Cipher.png>
Underfull \vbox (badness 2495) has occurred while \output is active []
- [19 <../Images/Cipher.png (PNG copy)>] [20]
-<../Images/TDMAFDMA.png, id=125, 254.53494pt x 133.33815pt>
+ [19 <../Images/Cipher.png (PNG copy)>]
+<../Images/TDMAFDMA.png, id=129, 254.53494pt x 133.33815pt>
File: ../Images/TDMAFDMA.png Graphic file (type png)
-<use ../Images/TDMAFDMA.png>
-<../Images/Frames.png, id=126, 331.28568pt x 291.39264pt>
+<use ../Images/TDMAFDMA.png> [20]
+<../Images/Frames.png, id=134, 331.28568pt x 291.39264pt>
File: ../Images/Frames.png Graphic file (type png)
<use ../Images/Frames.png>
-<../Images/Bursts.png, id=127, 371.90141pt x 134.78355pt>
+<../Images/Bursts.png, id=135, 371.90141pt x 134.78355pt>
File: ../Images/Bursts.png Graphic file (type png)
-<use ../Images/Bursts.png> [21 <../Images/TDMAFDMA.png (PNG copy)>] [22 <../Ima
-ges/Frames.png (PNG copy)> <../Images/Bursts.png (PNG copy)>] [23]
-<../Images/Channels.png, id=138, 272.60245pt x 169.47314pt>
+<use ../Images/Bursts.png>
+Underfull \vbox (badness 10000) has occurred while \output is active []
+
+ [21 <../Images/TDMAFDMA.png (PNG copy)>] [22 <../Images/Frames.png (PNG copy)>
+ <../Images/Bursts.png (PNG copy)>] [23]
+<../Images/Channels.png, id=145, 272.60245pt x 169.47314pt>
File: ../Images/Channels.png Graphic file (type png)
<use ../Images/Channels.png> [24 <../Images/Channels.png (PNG copy)>] [25]
-[26] <../Images/imsi_catcher.jpg, id=148, 280.15778pt x 225.73222pt>
+[26] <../Images/imsi_catcher.jpg, id=156, 280.15778pt x 225.73222pt>
File: ../Images/imsi_catcher.jpg Graphic file (type jpg)
<use ../Images/imsi_catcher.jpg>
-<../Images/usrp.jpg, id=149, 1204.5pt x 844.65562pt>
+<../Images/usrp.jpg, id=157, 1204.5pt x 844.65562pt>
File: ../Images/usrp.jpg Graphic file (type jpg)
<use ../Images/usrp.jpg>
-[27] <../Images/catcher_attack.png, id=155, 321.52924pt x 277.08318pt>
+[27] <../Images/catcher_attack.png, id=162, 322.25192pt x 277.08318pt>
File: ../Images/catcher_attack.png Graphic file (type png)
<use ../Images/catcher_attack.png> [28 <../Images/imsi_catcher.jpg> <../Images/
usrp.jpg>] [29 <../Images/catcher_attack.png (PNG copy)>]
-<../Images/replace_attack.png, id=162, 356.94153pt x 162.67976pt>
+<../Images/replace_attack.png, id=169, 356.86926pt x 178.43463pt>
File: ../Images/replace_attack.png Graphic file (type png)
-<use ../Images/replace_attack.png> [30]
-Underfull \vbox (badness 10000) has occurred while \output is active []
-
- [31 <../Images/replace_attack.png (PNG copy)>] [32]) (../Content/Detection.tex
- [33]
-[34
+<use ../Images/replace_attack.png> [30] [31 <../Images/replace_attack.png (PNG
+copy)>]) (../Content/Detection.tex [32] [33] [34
]
Chapter 3.
-[35] <../Images/c123_pcb.png, id=182, 1284.8pt x 790.955pt>
+[35] <../Images/c123_pcb.png, id=189, 1284.8pt x 790.955pt>
File: ../Images/c123_pcb.png Graphic file (type png)
<use ../Images/c123_pcb.png> [36] [37]
-<../Images/OsmoStructure.png, id=189, 387.00584pt x 79.13565pt>
+<../Images/OsmoStructure.png, id=197, 387.00584pt x 79.13565pt>
File: ../Images/OsmoStructure.png Graphic file (type png)
<use ../Images/OsmoStructure.png> [38 <../Images/c123_pcb.png (PNG copy)>]
[39 <../Images/OsmoStructure.png (PNG copy)>]
-<../Images/sysinfo2marked.png, id=197, 261.32832pt x 440.55792pt>
+<../Images/sysinfo2marked.png, id=204, 261.32832pt x 440.55792pt>
File: ../Images/sysinfo2marked.png Graphic file (type png)
<use ../Images/sysinfo2marked.png> [40] [41 <../Images/sysinfo2marked.png (PNG
-copy)>] <../Images/Paging.png, id=204, 167.95547pt x 144.61227pt>
+copy)>] <../Images/Paging.png, id=211, 169.47314pt x 153.64603pt>
File: ../Images/Paging.png Graphic file (type png)
<use ../Images/Paging.png> [42] [43 <../Images/Paging.png (PNG copy)>] [44]
-[45] <../Images/neighbourhoods_fak.png, id=218, 1829.83624pt x 2708.1175pt>
+[45] <../Images/neighbourhoods_fak.png, id=225, 1829.83624pt x 2708.1175pt>
File: ../Images/neighbourhoods_fak.png Graphic file (type png)
<use ../Images/neighbourhoods_fak.png>
LaTeX Warning: Float too large for page by 3.59608pt on input line 329.
-
-LaTeX Warning: Citation `richy' on page 46 undefined on input line 341.
-
LaTeX Font Info: Font shape `T1/phv/bx/n' in size <14.4> not available
(Font) Font shape `T1/phv/b/n' tried instead on input line 366.
[46] [47 <../Images/neighbourhoods_fak.png (PNG copy)>] [48] [49] [50] [51]
-<../Images/Architecture_software.png, id=239, 341.76483pt x 182.91537pt>
+<../Images/Architecture_software.png, id=246, 341.76483pt x 182.91537pt>
File: ../Images/Architecture_software.png Graphic file (type png)
<use ../Images/Architecture_software.png> [52] [53 <../Images/Architecture_soft
@@ -1267,28 +1352,28 @@ ware.png (PNG copy)>]
LaTeX Font Info: Font shape `T1/pcr/m/it' in size <10.95> not available
(Font) Font shape `T1/pcr/m/sl' tried instead on input line 600.
[54]
-<../Images/ICDS.png, id=250, 1325.95375pt x 864.22874pt>
+<../Images/ICDS.png, id=257, 1325.95375pt x 864.22874pt>
File: ../Images/ICDS.png Graphic file (type png)
<use ../Images/ICDS.png> [55] [56 <../Images/ICDS.png (PNG copy)>] [57]
-<../Images/databases_window.png, id=261, 366.36874pt x 459.7175pt>
+<../Images/databases_window.png, id=268, 366.36874pt x 459.7175pt>
File: ../Images/databases_window.png Graphic file (type png)
<use ../Images/databases_window.png>
-<../Images/rules_window.png, id=262, 284.06125pt x 568.1225pt>
+<../Images/rules_window.png, id=269, 284.06125pt x 568.1225pt>
File: ../Images/rules_window.png Graphic file (type png)
<use ../Images/rules_window.png>
-<../Images/filter_window.png, id=263, 332.24126pt x 293.095pt>
+<../Images/filter_window.png, id=270, 332.24126pt x 293.095pt>
File: ../Images/filter_window.png Graphic file (type png)
<use ../Images/filter_window.png>
-<../Images/pch_window.png, id=264, 270.00874pt x 273.02pt>
+<../Images/pch_window.png, id=271, 270.00874pt x 273.02pt>
File: ../Images/pch_window.png Graphic file (type png)
<use ../Images/pch_window.png> [58] [59 <../Images/databases_window.png> <../Im
ages/rules_window.png> <../Images/filter_window.png (PNG copy)> <../Images/pch_
-window.png>] [60] <../Images/user_window.png, id=277, 368.37625pt x 469.755pt>
+window.png>] [60] <../Images/user_window.png, id=284, 368.37625pt x 469.755pt>
File: ../Images/user_window.png Graphic file (type png)
<use ../Images/user_window.png>
@@ -1303,13 +1388,13 @@ Chapter 4.
Underfull \vbox (badness 7944) has occurred while \output is active []
[66]
-<../Images/catcherICDS.jpg, id=298, 3474.9825pt x 1906.12125pt>
+<../Images/catcherICDS.jpg, id=305, 3474.9825pt x 1906.12125pt>
File: ../Images/catcherICDS.jpg Graphic file (type jpg)
<use ../Images/catcherICDS.jpg> [67] [68 <../Images/catcherICDS.jpg>] [69]
[70] [71] [72] [73]) (../Content/Conclusion.tex [74]
Chapter 5.
-<../Images/flowchart.png, id=324, 340.31943pt x 407.31372pt>
+<../Images/flowchart.png, id=332, 340.31943pt x 407.31372pt>
File: ../Images/flowchart.png Graphic file (type png)
<use ../Images/flowchart.png> [75
@@ -1410,6 +1495,432 @@ Appendix B.
[89
+] [90] <../Images/t191cable.jpg, id=383, 702.625pt x 609.27625pt>
+File: ../Images/t191cable.jpg Graphic file (type jpg)
+
+<use ../Images/t191cable.jpg> [91 <../Images/t191cable.jpg>] [92
+
+
+]
+Appendix C.
+
+Underfull \hbox (badness 10000) in paragraph at lines 149--165
+
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 149--165
+
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 149--165
+
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 166--198
+
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 166--198
+
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 166--198
+
+ []
+
+
+Underfull \vbox (badness 7981) has occurred while \output is active []
+
+ [93]
+[94]
+Underfull \hbox (badness 10000) in paragraph at lines 201--348
+
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 201--348
+
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 201--348
+
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 201--348
+
+ []
+
+
+Underfull \vbox (badness 10000) has occurred while \output is active []
+
+ [95]
+[96]
+Underfull \vbox (badness 10000) has occurred while \output is active []
+
+ [97]
+[98]
+Appendix D.
+<../Images/sysinfo1.png, id=410, 260.172pt x 393.1488pt>
+File: ../Images/sysinfo1.png Graphic file (type png)
+
+<use ../Images/sysinfo1.png>
+
+LaTeX Warning: Float too large for page by 0.9002pt on input line 356.
+
+<../Images/sysinfo2.png, id=411, 261.32832pt x 440.55792pt>
+File: ../Images/sysinfo2.png Graphic file (type png)
+
+<use ../Images/sysinfo2.png>
+
+LaTeX Warning: Float too large for page by 61.98238pt on input line 361.
+
+<../Images/sysinfo3.png, id=412, 284.45473pt x 373.49136pt>
+File: ../Images/sysinfo3.png Graphic file (type png)
+
+<use ../Images/sysinfo3.png>
+<../Images/sysinfo4.png, id=413, 252.07776pt x 370.0224pt>
+File: ../Images/sysinfo4.png Graphic file (type png)
+
+<use ../Images/sysinfo4.png> [99
+
+
+] [100 <../Images/sysinfo1.png (PNG copy)>]
+[101 <../Images/sysinfo2.png (PNG copy)>] [102 <../Images/sysinfo3.png (PNG cop
+y)>] [103 <../Images/sysinfo4.png (PNG copy)>] [104
+
+
+]
+Appendix E.
+[105]) (./Master.acr [106]
+Underfull \hbox (badness 2626) in paragraph at lines 73--74
+[]|\T1/ptm/m/n/10.95 Conférence Eu-ropéenne des Ad-min-is-tra-tions des
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 89--90
+[]|\T1/ptm/m/n/10.95 Electrically Erasable Pro-grammable Read-Only
+ []
+
+[107
+
+
+
+
+] [108] [109]) [110] (./Master.aux) )
+Here is how much of TeX's memory you used:
+ 25287 strings out of 493848
+ 471945 string characters out of 1152824
+ 750834 words of memory out of 3000000
+ 27886 multiletter control sequences out of 15000+50000
+ 83343 words of font info for 111 fonts, out of 3000000 for 9000
+ 714 hyphenation exceptions out of 8191
+ 61i,13n,72p,1076b,1344s stack positions out of 5000i,500n,10000p,200000b,50000s
+{/usr/share/texmf-texlive/fonts/enc/dvips/
+base/8r.enc}{/usr/share/texmf/fonts/enc/dvips/cm-super/cm-super-t1.enc}</usr/sh
+are/texmf-texlive/fonts/type1/public/amsfonts/cm/cmex10.pfb></usr/share/texmf-t
+exlive/fonts/type1/public/amsfonts/cm/cmmi10.pfb></usr/share/texmf-texlive/font
+s/type1/public/amsfonts/cm/cmmi12.pfb></usr/share/texmf-texlive/fonts/type1/pub
+lic/amsfonts/cm/cmmi8.pfb></usr/share/texmf-texlive/fonts/type1/public/amsfonts
+/cm/cmr10.pfb></usr/share/texmf-texlive/fonts/type1/public/amsfonts/cm/cmr8.pfb
+></usr/share/texmf-texlive/fonts/type1/public/amsfonts/cm/cmsy10.pfb></usr/shar
+e/texmf-texlive/fonts/type1/public/amsfonts/cm/cmsy8.pfb></usr/share/texmf-texl
+ive/fonts/type1/public/eurosym/feymr10.pfb></usr/share/texmf-texlive/fonts/type
+1/public/amsfonts/latxfont/lcircle1.pfb></usr/share/texmf/fonts/type1/public/cm
+-super/sfrm1095.pfb></usr/share/texmf-texlive/fonts/type1/urw/courier/ucrb8a.pf
+b></usr/share/texmf-texlive/fonts/type1/urw/courier/ucrr8a.pfb></usr/share/texm
+f-texlive/fonts/type1/urw/courier/ucrro8a.pfb></usr/share/texmf-texlive/fonts/t
+ype1/urw/helvetic/uhvb8a.pfb></usr/share/texmf-texlive/fonts/type1/urw/times/ut
+mb8a.pfb></usr/share/texmf-texlive/fonts/type1/urw/times/utmr8a.pfb></usr/share
+/texmf-texlive/fonts/type1/urw/times/utmr8a.pfb></usr/share/texmf-texlive/fonts
+/type1/urw/times/utmri8a.pfb>
+Output written on Master.pdf (122 pages, 20433743 bytes).
+PDF statistics:
+ 517 PDF objects out of 1000 (max. 8388607)
+ 0 named destinations out of 1000 (max. 500000)
+ 183 words of extra memory for PDF output out of 10000 (max. 10000000)
+
+ng: Reference `fig:databases_window' on page 57 undefined on input l
+ine 676.
+
+
+LaTeX Warning: Reference `fig:pch_window' on page 57 undefined on input line 68
+0.
+
+[57] <../Images/databases_window.png, id=261, 366.36874pt x 459.7175pt>
+File: ../Images/databases_window.png Graphic file (type png)
+
+<use ../Images/databases_window.png>
+<../Images/rules_window.png, id=262, 284.06125pt x 568.1225pt>
+File: ../Images/rules_window.png Graphic file (type png)
+
+<use ../Images/rules_window.png>
+<../Images/filter_window.png, id=263, 332.24126pt x 293.095pt>
+File: ../Images/filter_window.png Graphic file (type png)
+
+<use ../Images/filter_window.png>
+<../Images/pch_window.png, id=264, 270.00874pt x 273.02pt>
+File: ../Images/pch_window.png Graphic file (type png)
+
+<use ../Images/pch_window.png>
+
+LaTeX Warning: Reference `fig:icds' on page 58 undefined on input line 719.
+
+
+LaTeX Warning: Reference `fig:databases_window' on page 58 undefined on input l
+ine 732.
+
+[58] [59 <../Images/databases_window.png> <../Images/rules_window.png> <../Imag
+es/filter_window.png (PNG copy)> <../Images/pch_window.png>] [60]
+<../Images/user_window.png, id=277, 368.37625pt x 469.755pt>
+File: ../Images/user_window.png Graphic file (type png)
+
+<use ../Images/user_window.png>
+
+LaTeX Warning: Reference `fig:user_mode' on page 61 undefined on input line 771
+.
+
+
+Underfull \vbox (badness 10000) has occurred while \output is active []
+
+ [61 <../Images/user_window.png>]
+
+LaTeX Warning: Citation `catcher_catcher' on page 62 undefined on input line 79
+3.
+
+) (../Content/Evaluation.tex [62]
+Chapter 4.
+
+LaTeX Warning: Reference `tab:key_data' on page 63 undefined on input line 14.
+
+[63
+
+
+]
+
+LaTeX Warning: Reference `tab:key_data' on page 64 undefined on input line 65.
+
+
+LaTeX Warning: Reference `fig:durations' on page 64 undefined on input line 67.
+
+
+[64]
+
+LaTeX Warning: Reference `tab:coverage' on page 65 undefined on input line 86.
+
+
+LaTeX Warning: Reference `tab:pagings' on page 65 undefined on input line 117.
+
+[65]
+
+LaTeX Warning: Reference `sec:paging' on page 66 undefined on input line 135.
+
+
+Underfull \vbox (badness 7944) has occurred while \output is active []
+
+ [66]
+
+LaTeX Warning: Citation `dennis' on page 67 undefined on input line 163.
+
+
+LaTeX Warning: Reference `fig:setup' on page 67 undefined on input line 170.
+
+<../Images/catcherICDS.jpg, id=298, 3474.9825pt x 1906.12125pt>
+File: ../Images/catcherICDS.jpg Graphic file (type jpg)
+
+<use ../Images/catcherICDS.jpg>
+
+LaTeX Warning: Reference `fig:openbts_parameters' on page 67 undefined on input
+ line 187.
+
+[67] [68 <../Images/catcherICDS.jpg>]
+
+LaTeX Warning: Reference `tab:err_configs' on page 69 undefined on input line 2
+31.
+
+
+LaTeX Warning: Reference `tab:config_rules_eval' on page 69 undefined on input
+line 278.
+
+[69] [70]
+
+LaTeX Warning: Reference `tab:par_change' on page 71 undefined on input line 30
+5.
+
+
+LaTeX Warning: Reference `sec:lac_change_test' on page 71 undefined on input li
+ne 306.
+
+[71]
+
+LaTeX Warning: Reference `tab:longterm_test' on page 72 undefined on input line
+ 340.
+
+
+LaTeX Warning: Reference `tab:consistent_parameters' on page 72 undefined on in
+put line 382.
+
+
+LaTeX Warning: Reference `sec:attacks' on page 72 undefined on input line 401.
+
+[72] [73]) (../Content/Conclusion.tex [74]
+Chapter 5.
+
+LaTeX Warning: Reference `fig:decision_process' on page 75 undefined on input l
+ine 20.
+
+<../Images/flowchart.png, id=324, 340.31943pt x 407.31372pt>
+File: ../Images/flowchart.png Graphic file (type png)
+
+<use ../Images/flowchart.png> [75
+
+
+] [76 <../Images/flowchart.png (PNG copy)>]
+[77]) [78] (./Master.bbl
+Underfull \hbox (badness 3179) in paragraph at lines 4--9
+[]\T1/ptm/m/sc/10.95 3GPP Tech-ni-cal Spec-i-fi-ca-tion Group Core Net-work and
+ Ter-
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 4--9
+\T1/pcr/m/n/10.95 http : / / www . 3gpp . org / ftp / Specs / archive / 23 _ se
+ries / 23 . 003 /
+ []
+
+
+Underfull \hbox (badness 2753) in paragraph at lines 11--16
+[]\T1/ptm/m/sc/10.95 3GPP Tech-ni-cal Spec-i-fi-ca-tion Group GSM/EDGE Ra-dio A
+c-cess
+ []
+
+
+Underfull \hbox (badness 7238) in paragraph at lines 11--16
+\T1/ptm/m/sc/10.95 Net-work\T1/ptm/m/n/10.95 . Data link (DL) Layer: Gen-eral
+as-pects. \T1/ptm/m/it/10.95 TS 04.05\T1/ptm/m/n/10.95 ,
+ []
+
+
+Underfull \hbox (badness 1112) in paragraph at lines 11--16
+\T1/ptm/m/it/10.95 DOC file $\T1/pcr/m/n/10.95 http : / / www . 3gpp . org / ft
+p / Specs / archive / 04 _ series /
+ []
+
+
+Underfull \hbox (badness 1112) in paragraph at lines 18--23
+\T1/ptm/m/it/10.95 DOC file $\T1/pcr/m/n/10.95 http : / / www . 3gpp . org / ft
+p / Specs / archive / 05 _ series /
+ []
+
+[79
+
+
+
+
+
+] (/usr/share/texmf-texlive/tex/latex/ucs/data/uni-32.def
+File: uni-32.def 2004/10/17 UCS: Unicode data U+2000..U+20FF
+)
+Underfull \hbox (badness 1210) in paragraph at lines 112--117
+[]\T1/ptm/m/sc/10.95 OsmocomBB\T1/ptm/m/n/10.95 . Catcher Catcher. \T1/ptm/m/
+it/10.95 Project Wiki\T1/ptm/m/n/10.95 , $\T1/pcr/m/n/10.95 http : / / opensour
+ce .
+ []
+
+[80]
+Underfull \hbox (badness 1783) in paragraph at lines 162--167
+[]\T1/ptm/m/sc/10.95 Telecomunication stan-dard-iza-tion sec-tor of ITU\T1/ptm/
+m/n/10.95 . List of Mo-
+ []
+
+
+Underfull \hbox (badness 1259) in paragraph at lines 162--167
+\T1/ptm/m/n/10.95 bile Coun-try or Ge-o-graph-i-cal Area Codes. \T1/ptm/m/it/1
+0.95 Com-ple-ments to Rec-om-men-da-
+ []
+
+
+Underfull \hbox (badness 10000) in paragraph at lines 194--199
+\T1/pcr/m/n/10.95 wikipedia . org / wiki / Central _ Equipment _ Identity _ Reg
+ister$\T1/ptm/m/n/10.95 ,
+ []
+
+) [81] [82
+
+
+] (./Master.lof
+
+LaTeX Warning: Citation `GSM2009' on page 83 undefined on input line 4.
+
+
+LaTeX Warning: Citation `GSM_history2011' on page 83 undefined on input line 4.
+
+
+
+LaTeX Warning: Citation `GSM_stats2011' on page 83 undefined on input line 4.
+
+
+LaTeX Warning: Citation `GSM2009' on page 83 undefined on input line 8.
+
+
+LaTeX Warning: Citation `kommsys2006' on page 83 undefined on input line 9.
+
+
+LaTeX Warning: Citation `GSM2009' on page 83 undefined on input line 12.
+
+
+LaTeX Warning: Citation `fox' on page 83 undefined on input line 14.
+
+
+LaTeX Warning: Citation `def_catcher' on page 83 undefined on input line 14.
+
+
+LaTeX Warning: Citation `mueller' on page 83 undefined on input line 15.
+
+
+LaTeX Warning: Citation `osmo_wiki_c123' on page 83 undefined on input line 18.
+
+
+
+LaTeX Warning: Citation `protocols1999' on page 83 undefined on input line 20.
+
+[83])
+\tf@lof=\write9
+\openout9 = `Master.lof'.
+
+ [84] (./Master.lot
+
+LaTeX Warning: Citation `protocols1999' on page 85 undefined on input line 4.
+
+
+LaTeX Warning: Citation `kommsys2006' on page 85 undefined on input line 6.
+
+
+LaTeX Warning: Citation `GSM2009' on page 85 undefined on input line 9.
+
+)
+\tf@lot=\write10
+\openout10 = `Master.lot'.
+
+ [85
+
+
+] (../Content/Appendix.tex [86
+
+
+]
+Appendix A.
+[87] [88]
+Appendix B.
+[89
+
+
] [90] <../Images/t191cable.jpg, id=376, 702.625pt x 609.27625pt>
File: ../Images/t191cable.jpg Graphic file (type jpg)
@@ -1482,6 +1993,10 @@ Underfull \vbox (badness 10000) has occurred while \output is active []
[97]
[98]
Appendix D.
+
+LaTeX Warning: Citation `protocols1999' on page 99 undefined on input line 351.
+
+
<../Images/sysinfo1.png, id=402, 260.172pt x 393.1488pt>
File: ../Images/sysinfo1.png Graphic file (type png)
@@ -1513,11 +2028,7 @@ y)>] [103 <../Images/sysinfo4.png (PNG copy)>] [104
]
Appendix E.
-)
-
-LaTeX Warning: `!h' float specifier changed to `!ht'.
-
-(./Master.acr [105] [106]
+[105]) (./Master.acr [106]
Underfull \hbox (badness 2626) in paragraph at lines 73--74
[]|\T1/ptm/m/n/10.95 Conférence Eu-ropéenne des Ad-min-is-tra-tions des
[]
@@ -1532,15 +2043,27 @@ Underfull \hbox (badness 10000) in paragraph at lines 89--90
-] [108] [109]) [110] (./Master.aux)
+] [108]
+
+Package longtable Warning: Column widths have changed
+(longtable) in table E.3 on input line 353.
+
+[109])
+
+Package longtable Warning: Table widths have changed. Rerun LaTeX.
+
+[110] (./Master.aux)
LaTeX Warning: There were undefined references.
+
+LaTeX Warning: Label(s) may have changed. Rerun to get cross-references right.
+
)
Here is how much of TeX's memory you used:
25287 strings out of 493848
471945 string characters out of 1152824
- 750814 words of memory out of 3000000
+ 749599 words of memory out of 3000000
27886 multiletter control sequences out of 15000+50000
83343 words of font info for 111 fonts, out of 3000000 for 9000
714 hyphenation exceptions out of 8191
@@ -1561,7 +2084,7 @@ nts/type1/urw/helvetic/uhvb8a.pfb></usr/share/texmf-texlive/fonts/type1/urw/tim
es/utmb8a.pfb></usr/share/texmf-texlive/fonts/type1/urw/times/utmr8a.pfb></usr/
share/texmf-texlive/fonts/type1/urw/times/utmr8a.pfb></usr/share/texmf-texlive/
fonts/type1/urw/times/utmri8a.pfb>
-Output written on Master.pdf (120 pages, 20274633 bytes).
+Output written on Master.pdf (120 pages, 20418036 bytes).
PDF statistics:
505 PDF objects out of 1000 (max. 8388607)
0 named destinations out of 1000 (max. 500000)
diff --git a/Tex/Master/Master.lot b/Tex/Master/Master.lot
index 7fce79b..e0e4666 100644
--- a/Tex/Master/Master.lot
+++ b/Tex/Master/Master.lot
@@ -1,7 +1,7 @@
\select@language {english}
\addvspace {10\p@ }
\addvspace {10\p@ }
-\contentsline {table}{\numberline {2.1}{\ignorespaces Subset of data stored on a SIM card. Adopted from \cite {protocols1999}}}{10}
+\contentsline {table}{\numberline {2.1}{\ignorespaces Subset of data stored on a SIM card. Adopted \cite {protocols1999}}}{10}
\contentsline {table}{\numberline {2.2}{\ignorespaces Mobile Country and Network Codes. (R) denotes that the MCC is reserved but not operational as of yet, whereas (T) denotes a operational test network.}}{11}
\contentsline {table}{\numberline {2.3}{\ignorespaces Frequencies in the different bands \cite {kommsys2006}.}}{16}
\addvspace {10\p@ }
diff --git a/Tex/Master/Master.pdf b/Tex/Master/Master.pdf
index 415e7b8..ae9aabf 100644
--- a/Tex/Master/Master.pdf
+++ b/Tex/Master/Master.pdf
Binary files differ
diff --git a/Tex/Master/Master.tex b/Tex/Master/Master.tex
index 4302782..e32ea6c 100644
--- a/Tex/Master/Master.tex
+++ b/Tex/Master/Master.tex
@@ -129,9 +129,6 @@
\clearpage
\input{../Content/Acknowledgements}
\clearpage
-\newpage
-\phantom{a}
-\newpage
\input{../Content/Dedication}
\clearpage
diff --git a/Tex/Master/Master.toc b/Tex/Master/Master.toc
index 6375272..aed6e60 100644
--- a/Tex/Master/Master.toc
+++ b/Tex/Master/Master.toc
@@ -29,12 +29,12 @@
\contentsline {paragraph}{Physical Layer (Layer 1):}{26}
\contentsline {paragraph}{Data Link (Layer 2):}{26}
\contentsline {paragraph}{Network (Layer 3):}{27}
-\contentsline {section}{\numberline {2.4}IMSI-Catcher}{27}
+\contentsline {section}{\numberline {2.4}IMSI Catcher}{27}
\contentsline {subsection}{\numberline {2.4.1}Mode of Operation}{28}
\contentsline {subsubsection}{Attacks}{30}
\contentsline {paragraph}{MS is in normal cell selection mode:}{30}
\contentsline {paragraph}{MS is already connected to a network:}{30}
-\contentsline {subsubsection}{Risks and Irregularities}{32}
+\contentsline {subsubsection}{Risks and Irregularities}{31}
\contentsline {subsection}{\numberline {2.4.2}Law Situation in Germany}{32}
\contentsline {chapter}{\numberline {3}IMSI Catcher Detection System}{35}
\contentsline {section}{\numberline {3.1}Framework and Hardware}{35}
@@ -80,6 +80,7 @@
\contentsline {chapter}{\numberline {5}Conclusion}{75}
\contentsline {section}{\numberline {5.1}Summary}{75}
\contentsline {section}{\numberline {5.2}Future Work}{77}
+\contentsline {paragraph}{}{78}
\contentsline {chapter}{Bibliography}{79}
\contentsline {chapter}{\numberline {A}GSM}{87}
\contentsline {section}{\numberline {A.1}Interfaces}{87}
@@ -94,5 +95,5 @@
\contentsline {chapter}{\numberline {D}System Information}{99}
\contentsline {chapter}{\numberline {E}Evaluation Data}{105}
\contentsline {section}{\numberline {E.1}Rx and LAC Change Test}{105}
-\contentsline {section}{\numberline {E.2}Database Rules Test}{105}
+\contentsline {section}{\numberline {E.2}Database Rules Test}{106}
\contentsline {chapter}{Acronyms}{107}