Femtocells Podcast

Today, Mike Qaissaunee and I recorded a podcast on Femtocells. You may not be familiar with these devices - Femtocells are just starting to be deployed in a broad range of applications with major network operators announcing rollouts in the USA, Europe and Asia. They are basically small cellular base stations that people can put in their homes or businesses. They connect using a broadband connection (DSL, Cable, Fiber, etc) in the home or business. ABI Research forecasts that the total femtocell market in 2010 will reach 2.3 million units, and will exceed 45 million within five years. In this podcast we take a look at this emerging communications technology.

Here's some of the questions we discuss and answer:

1. What are femtocells?
2. How many phones can they support?
3. Are products currently available?
4. Let’s pick one and dig a little deeper on the device features. How about AT&T since it is the newest offering.
5. So, you need to have a broadband connection on the site in place?
6. Why is there a GPS radio in a Femtocell device?
7. What about Femtocell Quality of Service or QoS?
8. Are the Sprint and Verizon products 3G like AT&T’s?
9. What about pricing?
10. Is there a monthly fee?
11. So, we had talked about the problem Mark was having with lack of cellular signal in his home and office. Would one of these in his home and another in his business solve his problem?

Here's how to listen:

To access show notes and audio of our 18 minute and 7 second audio podcast titled Femtocells click here.

Listen to it directly in your web browser by clicking here.

If you have iTunes installed you can subscribe to our podcasts by clicking here.

Baseband Hacking Using Fake Cell Towers

In my last post I wrote about femtocells and femotozone services. Femtocells are little mini-antennas that can be place in a home, business, hotel, etc that connect using a broadband connection (DSL, Cable, Fiber, etc). They are great when it comes to filling in areas of poor cell reception.

Baseband hacking is described in an IDG News Service report along with a LinuxInsider report. Basically, the attack involves setting up a fake cell tower. There’s a couple of ways to do this - you can spend around $2000 and build your own cell tower or you can purchase a femtocell from one of the providers (AT&T, Verizon, etc) for $150-$200.

How can devices like femtocells be used by hackers? This is from a post over at ReadWriteWeb titled Baseband Hacking: A New Frontier for Smartphone Break-ins:

Security researcher Ralf-Philipp Weinmann says he has found a new way to hack into mobile devices - by using a baseband hack that takes advantage of bugs found in the firmware on mobile phone chipsets sold by Qualcomm and Infineon Technologies. Weinmann will demonstrate the hack on both an iPhone and an Android device at this week's Black Hat conference in Washington D.C.

To perform the attack according to Weinmann, a hacker sets up a rogue base transceiver station which is used to send malicious code over the air to the target devices. The code exploits vulnerabilities found in the GSM/3GPP stacks on the phones' baseband processors. Weinmann goes on to say industry bodies like the GSM Association and the European Telecommunications Standards Institute have not considered the possibility of attacks like this.

What’s really interesting about this is the attack exploits bugs in chip firmware which is something most hackers do not have a lot of experience with. What’s firmware? Here’s a quick definition from Wikipedia:

In electronics and computing, firmware is a term often used to denote the fixed, usually rather small, programs and/or data structures that internally control various electronic devices.

The Wikipedia definition goes on:

The term firmware was originally coined in order to contrast to higher level software which could be changed without replacing a hardware component, and firmware is typically involved with very basic low-level operations without which a device would be completely non-functional.

Most hacks to this point have been software based and not firmware because it is typically much easier to hack using software. Here’s more from the ReadWriteWeb post:

According to Sophos security consultant Graham Cluley, "if someone wanted to spy on your mobile phone conversations it would be easier to trick the user into installing an app that spied on them or gain physical access to the mobile to install some spyware code," he said. "I would be surprised if anyone went to all of the effort that this researcher suggests."

Interesting stuff.

Femtozone Services

I’ve written and Mike Q and I have podcast in the past about femtocells and how they are being used to enhance indoor cellular coverage. If you haven’t heard of them - they are basically small cellular base stations that can be put in homes or businesses. Femtocells connect using a broadband connection (DSL, Cable, Fiber, etc) in the home or business and are great in areas of poor cell reception. 

I’m not sure why they are not used more in the U.S. When I get stuck in a hotel or business where cellular coverage is poor I often find myself mumbling “This place could sure use some femtos”.

Lately I’ve been picking up some chatter about “femtozone services” and just read an interesting study from ABI Research titled Consumer Femtozone Services. According to ABI, femtozone services use key attributes such as location and presence to trigger innovative applications residing on the mobile device, or in the access point, the core gateway, or the cloud.

Here’s a few examples of how femtozone services can be used from that ABI study:

A young person arrives at the family home, and the femtocell there registers the presence of his or her mobile phone and sends out an SMS notification to the parents. Such systems are already in use in Japan. Other kinds of femtozone applications can turn on lights or activate security systems, while still others can be used to sync content between mobile phones and other devices in the home such as TVs, laptops and media players. Via the mobile network, they can even allow remote access to digital content stored at home.

ABI goes on to forecast:

About 2.3 million femtozone subscribers in 2012, providing revenue of more than $100 million. These numbers rise sharply to 2015, when 45% of femtocell users will subscribe to femtozone services. Femtozone services will see initial adoption in the Asia-Pacific region, but ultimately the North American market will be by far the largest.

ABI Practice director Aditya Kaul says, “Femtozone services will be bundled with femtocell subscriptions and will also be available individually, increasing the perceived value of having a femtocell in the home. Eventually, mobile apps available from Apple or Google App stores may be designed to work via a femtocell. The femtozone services market is expected to reach almost $2 billion in revenue by 2015, but operators need to act fast, as the popularity of Wi-Fi/GPS-based over the top applications could pose a hindrance.”

Be sure to check out ABI Research’s Consumer Femtozone Services study. For more information, follow this link.

The Rise Of The HetNet

I’m starting to see the term HetNet used in my reading and even had a student ask me for details this morning. That said – I figured it would make a good blog post.

HetNet is short for Heterogeneous Network and is a term currently being used in the wireless world. Most of us are carrying around smartphones with a number of different antennas built in for access via different network technologies. The neat thing about HetNets is they are able to maintain mobile connectivity (no dropped connections) when switching between different wireless connection technologies. 

The three different connection technologies getting all the HetNet buzz right now are LTE, Carrier WiFi, and enterprise femtocells. LTE is 4G cellular service and Carrier WiFi is just WiFi service provided by a wireless carrier. Femtocells are small cell devices that are connected to an Internet broadband connection. 

So HetNets allow a user device to seamlessly switch from network type to network type– LTE to WiFi to femtocell and vice-versa back and forth without dropping a connection. Pretty neat.

Now, not too long ago, it was believed LTE would be the dominant mobile technology and there would not be a need to alternative type technologies like Carrier WiFi and femotocells. But think about it…… there is only a limited amount of spectrum and bandwidth so providers are looking for ways to lower the number of devices per cell. There are also advantages to having users as close as possible to the different types of base stations. 

As a result, we’re seeing providers like Verizon Wireless and AT&T use HetNets to improve the coverage of their network, increase network capacity to match user demand. enhance the user experience, and lower the cost of delivering mobile broadband services.

Wireless Shift: LTE Macrocells -> Small Base Stations

I’ve written about femtocells here in the past - basically micro-cell antennas that users attach to their broadband network. They are used to fill in areas where coverage is weak or does not exist. It looks like this idea is catching on. With increasing traffic demands along with OPEX and CAPEX savings in mind we’re starting to see a shift in the deployment of small range cell base stations (what some are calling simply “small cell”). 

Looking at a recent ABI Research report that examines the ecosystem and outlook for LTE base stations titled “The LTE Base Station Market,” we see the uptake of small cells and remote radio heads (RRHs) as elements of the distributed base station. 

Here’s some detail from the report:

• Operators will initially deploy small cell equipment as in fills on the pico and microcell layers, but will quickly transition to deploying them as a fundamental part of a network rollout. 
• The number of LTE small cells sold (127,000) will surpass the number of LTE macrocells, forecast at 113,000, as early as 2014. 
• Semiconductor suppliers are positioning themselves to participate in this market with TI, Freescale, Cavium, Mindspeed, and DesignArt among the manufacturers offering new “base station-on-a-chip” SoCs.
• However, LTE base station revenues will continue to be dominated by macro base station revenue with small cell revenue of $1.09 billion representing only 5.2% of the total revenue of $20.86 billion in 2014 and growing to $4.44 billion or 23.9% of the total $18.60 billion LTE base station market by 2016.
• Equipment manufacturers have been quick to respond to this shift in RAN (Radio Access Network) architecture. Ericsson acquired BelAir networks as part of its “HetNet” initiative, Nokia Siemens Networks announced Flexi Zone, Alcatel-Lucent continues to expand its lightRadio™ portfolio and Huawei has announced its AtomCell products.

Nick Marshall, principal ABI Networks Analyst, comments regarding the report, “This mobile broadband-driven data storm is stretching traditional macrocell network capacity to the limit and driving the move to heterogeneous networks.” Nick continues, saying, “These base station baseband SoCs (System on a Chip) are among the most complex ICs on the market today and raise the bar in terms of complexity.”