GSM location tracking with GNU Radio?

819 views
Skip to first unread message

Dan W

unread,
Jul 8, 2010, 10:25:24 AM7/8/10
to London Hack Space
Hello folks,

I was wondering how hard it would be to build something that could
track where nearby GSM phones are using just their signals to the
tower, similar to Path Intelligence[0][1]. I was thinking GNU Radio[2]
might be the right platform. This is probably a quite difficult task.

Has anyone tried this or has experience with GNU Radio?

Cheers,
Dan

[0] http://www.pathintelligence.com/website-prodnserv.htm
[1] http://radar.oreilly.com/2008/05/the-results-of-reality-mining.html
[2] http://gnuradio.org/redmine/wiki/gnuradio

Russ Garrett

unread,
Jul 8, 2010, 10:38:08 AM7/8/10
to london-h...@googlegroups.com
On 8 July 2010 15:25, Dan W <d...@iamdanw.com> wrote:
> I was wondering how hard it would be to build something that could
> track where nearby GSM phones are using just their signals to the
> tower, similar to Path Intelligence[0][1]. I was thinking GNU Radio[2]
> might be the right platform. This is probably a quite difficult task.
>
> Has anyone tried this or has experience with GNU Radio?

This is certainly possible with GNU Radio (damn near anything is).
Dominic is probably the best person to talk to about that - my GNU
Radio skills are lacking.

I have a USRP with the appropriate receiver for GSM, which is
notionally the Hackspace's (I own it but I don't use it much). You are
more than welcome to use it.

I assume this tech is just based on triangulation, which I guess means
you'll need at least 3 receivers (2 USRPs).

--
Russ Garrett
ru...@garrett.co.uk

Dominic

unread,
Jul 8, 2010, 11:32:26 AM7/8/10
to london-h...@googlegroups.com
On 8 July 2010 15:25, Dan W <d...@iamdanw.com> wrote:
> similar to Path Intelligence[0][1]. I was thinking GNU Radio[2]

GNU Radio is a great platform for this, in fact Path Intelligence use
USRPs for their system.

Path Intelligence contributed some of their code to the gnuradio
project, specifically the multiple USRP stuff so that simplifies that
part. There's also a reasonable amount of GSM code available
(openBTS, thc.org), so we probably wouldn't even need to write out own
signal processing blocks.

The part that I think is most difficult is getting it accurate enough
to get a reliable position from someone's phone.

> Has anyone tried this or has experience with GNU Radio?

I've got experience with GNU Radio but my daughterboard is 2.4GHz so
it's useless for this application. I'd suggest that trying to pick up
the signal with Russ's USRP would be a good place to start, writing a
simple receiver should be fairly straight forward with the GRC
application.

I'd be happy to discuss it/give it a try at the next Wednesday meeting.

Russ Garrett

unread,
Jul 8, 2010, 11:40:06 AM7/8/10
to london-h...@googlegroups.com
On 8 July 2010 16:32, Dominic <domi...@gmail.com> wrote:
> I've got experience with GNU Radio but my daughterboard is 2.4GHz so
> it's useless for this application.  I'd suggest that trying to pick up
> the signal with Russ's USRP would be a good place to start, writing a
> simple receiver should be fairly straight forward with the GRC
> application.
>
> I'd be happy to discuss it/give it a try at the next Wednesday meeting.

I think there's probably a good little workshop in that!

(I wonder how Path Intelligence manages to keep good enough clock sync
between all the USRPs at relatively long distances.)

--
Russ Garrett
ru...@garrett.co.uk

Mark Steward

unread,
Jul 8, 2010, 5:41:38 PM7/8/10
to London Hack Space
I don't think they need to: from what I've heard, there's no timing
information that helps with triangulation, so you're merely sampling
from a datastream.

If you only need to triangulate the signal, rather than tracking the
TMSI, you can probably just use a number of signal detectors. Magnus
and I played with this a few weeks back:
http://interface.khm.de/index.php/lab/experiments/radio-signal-strength-sensor/
You'll want to build a few, but you'll find they're a bit cheaper than
USRPs. We also tried
http://www.electro-tech-online.com/attachments/electronic-projects-design-ideas-reviews/3234d1100830039-rf-signal-mobile-phone-detector-mobile_phone_tracker.pdf,
which is meant to be more directional, but found it a bit delicate.

Don't forget to check this page http://en.wikipedia.org/wiki/GSM_frequency_ranges.


Mark

On Jul 8, 4:40 pm, Russ Garrett <r...@garrett.co.uk> wrote:
> r...@garrett.co.uk

Russ Garrett

unread,
Jul 9, 2010, 3:43:41 AM7/9/10
to london-h...@googlegroups.com
On 8 July 2010 22:41, Mark Steward <marks...@gmail.com> wrote:
> If you only need to triangulate the signal, rather than tracking the
> TMSI, you can probably just use a number of signal detectors.  Magnus
> and I played with this a few weeks back:
> http://interface.khm.de/index.php/lab/experiments/radio-signal-strength-sensor/
> You'll want to build a few, but you'll find they're a bit cheaper than
> USRPs.  We also tried
> http://www.electro-tech-online.com/attachments/electronic-projects-design-ideas-reviews/3234d1100830039-rf-signal-mobile-phone-detector-mobile_phone_tracker.pdf,
> which is meant to be more directional, but found it a bit delicate.

Surely the TMSI isn't going to give you anywhere near enough location accuracy?

Path Intelligence's patent is here - it's surprisingly readable:
http://bit.ly/bpOsZf

"A plurality of receivers distributed throughout the specified area
monitor the area for wireless communication from a mobile device.
Mobile devices are identified by way of a unique identifier, e.g.
IMSI, IMEI, MAC address, or similar transmitted on a control channel
or the like. Whenever such wireless communication is detected, the
direction from which the signal is received is detected. The position
of the mobile device (and hence the person carrying it) may be
calculated by triangulating results from two or more receiving
devices, and the results stored."

The patent suggests that the receiving device calculates a direction
to the transmitter by using an array of receivers - this suggests to
me that each Path Intelligence receiving station is probably 2 or more
synchronised USRPs (!) but the receiving stations themselves don't
need to be tightly synchronised (although it does mention
synchronising them using GPS).

--
Russ Garrett
ru...@garrett.co.uk

Adam Last

unread,
Jul 9, 2010, 6:53:34 AM7/9/10
to london-h...@googlegroups.com
I have a friend who works on GPS chipsets. One of his recent projects
is working with the manufacturer of a mobile phone picocell
manufacturer. He was making a tiny GPS module for them that didn't
really care about position but was all about using the GPS signal for
precise timing and synchronisation.

Troy Sanders

unread,
Oct 31, 2013, 4:38:59 PM10/31/13
to london-h...@googlegroups.com
Hi Russ,

I realize that this is a old post but were able to do anything with this?
Reply all
Reply to author
Forward
0 new messages