Radio resource location services protocol explained

Radio resource location services (LCS) protocol (RRLP) applies to GSM and UMTS Cellular Networks. It is used to exchange messages between a handset and an SMLC in order to provide geolocation information;^[1] e.g., in the case of emergency calls. The protocol was developed in order to fulfil the Wireless Enhanced 911 requirements in the United States. However, since the protocol does not require any authentication, and can be used outside of a voice call or SMS transfer, its use is not restricted to emergency calls and can be used by law enforcement to pinpoint the exact geolocation of the target's mobile phone. RRLP was first specified in 3GPP TS 04.31 - Location Services (LCS); Mobile Station (MS) - Serving Mobile Location Centre (SMLC); Radio Resource LCS Protocol (RRLP).^[2]

Harald Welte proved at HAR2009^[3] that many high-end smart-phones submit their GPS location to the mobile operator when requested. This happened without any sort of authentication.

RRLP parameters

Positioning methods

RRLP supports two positioning methods:

E-OTD: The Enhanced Observed Time Difference (E-OTD) is based on measurements inside the mobile phone, where the phone measures the observed time difference of arrival of bursts sent by nearby pairs of base transceiver stations.

GPS: This method uses the GPS (Global Positioning System) for achieving geolocation. To support this, the phone needs to have a built-in GPS receiver.

Method type

The method type indicates whether MS based or assisted location is to be performed.

MS assisted: The MS (mobile phone) performs E-OTD or GPS measurements, and passes the raw measurement data to the network. The computation of the geolocation is then performed inside the carrier network, not on the phone itself.

MS based: The MS (mobile phone) performs E-OTD or GPS measurements, and successively performs the complete computation of the geolocation inside the phone. The result of this computation is then sent back to the carrier network.

In this mode, the network typically needs to send so-called assistance data to the phone.

References

1. http://www.inacon.de/glossary/RRLP.php INACON Glossary
2. http://www.3gpp.org/ftp/Specs/html-info/0431.htm 3GPP specification TS 04.31
3. http://laforge.gnumonks.org/blog/20091013-har2009_report/ Harald Welte on OpenBSC and HAR2009