Introduction
DTC, Direct to Cell, literally puts the ground base stations onto low earth orbit satellites so that a common mobile phone can connect to the satellites directly using the same 3GPP cellular frequency bands. As of the time of writing this document, the following frequency bands are used:
- T-Mobile PCS G-block, 1910-1915 MHz uplink and 1990-1995 MHz downlink;
- IMT PCS H-block, 1915-1920 MHz uplink and 1915-2000 MHz downlink;
- AWS-4 band, 2000-2020 MHz uplink and 2180-2200 MHz downlink.
Merging and summarizing the above frequency bands, we arrive at the following conclusion: the uplink frequencies are constrained in “1910-1920” MHz (10 MHz wide) and “2000-2020” MHz (20 MHz wide).
The purpose of this paper is not to analyze the space communication technologies, but to discuss and propose an efficient method for detecting such signals. For political reasons associated with the national sovereignty, there might be restrictions on user access to such space communication service. From test and measurement perspective, we need a system that can reliably detect any unauthorized communication signals between a cell phone and a satellite.
Detecting uplink, not the downlink
To detect unauthorized DTC usage, the best is to detect the “illegal” uplink signal event from the phone, not the downlink signal from the satellite, for the following reasons:
- The 4G technology used in DTC is FDD-LTE type, not TDD-LTE type. In FDD type, the uplink is confined within its own pristine frequency band, which makes signal intrusion event detection particularly simple: any energy event above reasonable noise background should be deemed suspicious.
- The detection instrument “sensor” (like our WSA-408) should be installed on the existing cell towers. These sensors will be much closer to the phones on ground than to the satellites in space. Even if the satellite transmitting power is 1000 times that of the phone, the actual downlink signal power arriving at the sensor location will be much lower than the uplink signal from a phone within 1 KM range, for example. So, detecting the uplink signals is more reliable for this particular application.
- The downlink signals from base stations (including those from the satellites) are always present, with or without active users. In contrast, the uplink bands should always be quiet until there is a phone actively transmitting signals in those bands. Detecting anomalous signal activity in a frequency band that’s normally quiet (signal intrusion event detection) is very straight forward, as long as the instrument (sensor) itself is clean (no spurious signals) and has good enough sensitivity (very low noise floor) and excellent out of band suppression (the signals from nearby base stations at adjacent downlink frequency bands will not saturate or de-sensitive the instrument).
Figure 1, picture of an actual WSA-408 instrument.
The key performance specifications are shown in the table below. The best-in-class sensitivity and dynamic range makes WSA-308 ideal for this DTC detection task.
Table 1, WSA-408 performance specifications.
A perfect solution, Multi-channel SA auto recording for DTC uplink
The WSA-408 offers a software feature termed “Multi-channel Spectrum Analysis with auto recording”. This test feature is perfect for DTC uplink detection, as shown in Figure 2.
Figure 2, an example setup for DTC detection using the Multi-channel SA auto recording test.
The test shown in Figure 2 accomplishes the following within a single test:
- User can set up multiple (8 on the GUI and 300 internally) discrete frequency bands. The example in Figure 2 shows two frequency bands used by DTC uplinks (1915 MHz and 2100 MHz) with bandwidth at each point being 10 MHz wide.
- User also sets up a detection threshold (10 dB as shown in Figure 2). Once a signal event with spectrum power 10 dB above the inherent noise floor, a trigger happens. The actual spectrum data associated with this event will be recorded inside the WSA-408’s embedded memory for later retrieval by a PC, and/or the spectrum data can also be sent to a remote server in real-time if network connection is available (only 1 mbps bandwidth is needed).
- The test runs autonomously without any reliance on external PC or server software. All test setups can be pre-configured and burned into the WSA-308 embedded flash memory. In the actual field deployment, it just needs to be powered on and will automatically start the detection algorithm.
FD-LTE up and down link signal examples
Figure 3 shows exemplary down-link FD-LTE signals from a ground-based base stations when a WSA-408 is located the 11th floor of a tall building (simulating deployment on a cell tower).
Figure 3, exemplary FD-LTE downlink signal spectrum from ground-based base stations.
Figure 4, FD-LTE uplink signals from phones down the street measured by a WSA-408 from the 11th floor of a tall building (simulating a cell tower).
