A Scalable Way to Measure Cellular Networks

MobileAtlas

MobileAtlas is a scalable, cost-efficient test framework for cellular networks that takes international roaming measurements to the next level. It implements the promising approach to geographically decouple SIM card and modem, which boosts the scalability and flexibility of the measurement platform. It offers versatile capabilities and a controlled environment that makes a good foundation for qualitative measurements. Further information can be found on our website.

Repository Directories (with README Files)

• root directory (this file): project overview and introduction of the most relevant framework components
• mobileatlas: mobileatlas python modules
• hardware: hardware specification and SIM tunneling technique
• setup: setup scripts that are used to install the MobileAtlas framework on a dedicated Raspberry Pi device
• probe-statuspage: documentation of lightweight status page that is running locally on the probes

Related Repositories

• mobile-atlas-management: management dashboard for admin interactions with deployed probes
• pySIM: forked version of pySIM that is used by SIM provider and measurement probe
• masters-thesis: thesis that utilized mobile-atlas to measure traffic classification and zero-rating
• wehe-server: wehe-server that was extended (support for multiple traffic streams, IPv6) and is used for measurements on the MobileAtlas platform
• wehe-client: counterpart to the adapted wehe-server; to be used within MobileAtlas the wehe client and pre-recorded traffic recordings are placed within the probe's measurement implementation

Publications

• [GLOBECOM22] Zero-Rating, One Big Mess: Analyzing Differential Pricing Practices of European MNOs

  @inproceedings{gegenhuber2022zero,
    title={Zero-Rating, One Big Mess: Analyzing Differential Pricing Practices of European MNOs},
    author={Gegenhuber, Gabriel K and Mayer, Wilfried and Weippl, Edgar},
    booktitle={GLOBECOM 2022-2022 IEEE Global Communications Conference},
    pages={203--208},
    year={2022},
    organization={IEEE}
  }

• [USENIX Security '23] MobileAtlas: Geographically Decoupled Measurements in Cellular Networks for Security and Privacy Research

  @inproceedings{gegenhuber2023mobileatlas,
    title={MobileAtlas: Geographically Decoupled Measurements in Cellular Networks for Security and Privacy Research},
    author={Gegenhuber, Gabriel K and Mayer, Wilfried and Weippl, Edgar and Dabrowski, Adrian},
    booktitle={32nd USENIX Security Symposium (USENIX Security 23)},
    pages={3493--3510},
    year={2023}
  }

Presentations

• [USENIX Security '23] MobileAtlas: Geographically Decoupled Measurements in Cellular Networks for Security and Privacy Research: Info, Slides
• [DEF CON 31] Cellular Carriers Hate this Trick: Using SIM Tunneling to Travel at Light Speed: Info, Recording, Slides
• [GSMA FASG#27] An Open-Source Framework for Rapid Distributed Security Testing and Measurements Based on SIM Tunneling

Geographical Decoupling of SIM Card and Modem

Physically moving devices and SIM cards between countries to enable measurements in a roaming environment is costly and does not scale well. Therefore, we introduce an approach to geographically detach the SIM card from the modem by tunneling the SIM card's protocol over the Internet and emulating its signal on the LTE modem. This allows us to test roaming effects on a large number of operators without physically moving any hardware between different countries. More specific details regarding the technical implementation of the SIM tunneling technique can be found in the README file of the hardware directory.

Framework Architecture

The framework can be structured into three main components: SIM providers that allow sharing SIM card access, measurement probes that act as a local breakout to the cellular network, and a management server that connects the prior two components and acts as command and control unit for the measurement probes.

SIM Provider

The SIM provider is used to remotely make one or more SIM cards available to the measurement platform. For communication between the computer and the SIM card, we rely on a modified version of pySim. The python file that implements the SIM provider is sim.py and uses the simprovider python module (virtualenv required). More specific details regarding the hardware requirements can be found in the README file of the hardware directory.

Measurement Probe

MobileAtlas probes are responsible for measurement execution. Each probe consists of a single-board computer with at least an Internet uplink, USB host support, and a GPIO interface. The python file that is used for test execution on a measurement probe is probe.py and uses the probe python module (virtualenv required). A detailed breakdown of all used hardware components can be found in the in the README file of the hardware directory.

Measurement Probe Deployment During Current Fieldtest

MobileAtlas is currently deployed in eight European countries: Austria, Belgium, Croatia, Finland, Germany, Romania, Slovakia, and Slovenia. Although our focus lies on countries within the EU we also have measurement probes in two American countries: Canada and USA.

We are looking for early adopters, who share interest in the topic and like to contribute to the success of MobileAtlas. Right now, we need people (or organizations, universities, research institutes, etc.) that host measurement probes. Further information can be found on our website.

SIMulator

Our MobileAtlas probes prove that only basic hardware (i.e., a UART interface and GPIO ports) is enough to accomplish full SIM tracing capabilities. To popularize SIM tracing and lower the entry barrier for hobbyists and other researchers, we therefore implemented a light-weight version of our SIM tunnel using ultra-lowcost hardware (i.e., a Raspberry Pi Pico). The Raspberry Pi Pico can operate in two modes when connecting to the modem: i) a synchronous mode, which requires an additional wire but automatically adapts to different clock (CLK) frequencies, and ii) an asynchronous mode, which simplifies wiring but requires one-time manually setting the CLK frequency (same as our MobileAtlas probes). To further broaden potential use cases, we experimentally extend support beyond SIM cards to other types of contact smartcards (i.e., both T=0 and T=1 cards), thereby also enabling the introspection and relaying of payment card communication.

Acknowledgments

MobileAtlas was developed at SBA Research and University of Vienna by Gabriel K. Gegenhuber, Wilfried Mayer, Adrian Dabrowski, and Philipp Frenzel.

We want to thank Fabian Funder for his practical work on the Pico-SIM-tunnel.

Additionally, thanks go to Markus Maier for his occasional advice and his help designing the SIM PCB.

Furthermore, we want to thank all hosters of measurement probes who made this work possible at all.

Funding

This project was funded through the NGI0 Entrust Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 101069594.

This project was funded through the NGI0 PET Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 825310.

This research was also funded by the Austrian Science Fund (FWF): P30637-N31.

Image credits

Blank map of Europe, licensed under Creative Commons Attribution-ShareAlike 3.0 Unported

License

MobileAtlas is licensed under GPLv3