• Radio-link level data
  • LTE PDCCH (Physical Downlink Control Channel) is unencrypted
  • Let’s decode it!
• Hybrid framework
  • HW: SDR plus mini-PC
  • SW: open-source software to decode DCI messages [Bui2016]
• Gathered information (raw data) every TTI (i.e. 1 ms)
  • C-RNTI: temporary user identifier
  • MCS: modulation and coding scheme 
  • RBs: no. of resource blocks assigned 
  • HARQ ID: HARQ process identifier
  • TBS: Transport Block Size (derived)

The tool for collecting LTE data is based on the open-source software called OWL.

The sniffer decodes of the LTE control channel, the Physical Downlink Control Channel (PDCCH) at runtime broadcasted by commercial LTE base station in an unencrypted fashion. Thanks to OWL, the sniffer is able to decode the control messages of LTE, called Downlink Control Information (DCI), devoted to assigning network resources to users for both downlink and uplink communications. Resources are assigned to devices through their radio network temporary identifiers (RNTIs), every millisecond, specifying the number of resource blocks (RBs) and the modulation and coding scheme (MCS) to be used. Consequently, the obtained dataset are both anonymous, because it is impossible to obtain users’ unique identifiers, and accurate because individual communication can be separated within the dataset for obtaining high-definition traces. Therefore, the datasets are useful to obtain both aggregated information on a given cell and to extract trace-based statistic distributions.

The hardware required is based on:

• Software Defined Radio (SDR), we are usual to use Nuand BladeRF x40
• A computer to manage the software, communicate with the SDR and store the collected traces

The scripts for collecting the traces can be found in the official distribution of OWL.

In case you need support, you can contact us.