05-05-2012, 10:42 AM
Dual Band Mobile Jammer for GSM 900 & GSM 1800 full report
[attachment=21327]
Abstract
This report presents the design, implementation, and testing of a dual-band cell-phone jammer. This jammer works at GSM 900 and GSM 1800 simultaneously and thus jams the three well-known carriers in Jordan (Zain, Orange, and Umniah). This project went through two phases:
Phase one: studying the GSM-system to find the best jamming technique, establishing the system design and selecting suitable components.
Phase two: buying all the needed components, drawing the overall schematics, fabricating the PCB layout, assembling the devices, performing some measurements and finally testing the mobile jammer.
The designed jammer was successful in jamming the three carriers in Jordan as will be shown at the end of this report.
4
1. Introduction
Communication jamming devices were first developed and used by military. This interest comes from the fundamental objective of denying the successful transport of information from the sender (tactical commanders) to the receiver (the army personnel), and vice-versa. Nowadays, mobile (or cell) phones are becoming essential tools in our daily life. Here in Jordan, for example, with a rather low population (around 5 million), three main cell phone carries are available; namely; Zain, Orange, and Umniah The first two use the GSM 900 system, while the third uses the GSM 1800 system. Needless to say, the wide use of mobile phones could create some problems as the sound of ringing becomes annoying or disrupting. This could happen in some places like conference rooms, law courts, libraries, lecture rooms and mosques. One way to stop these disrupting ringings is to install a device in such places which will inhibit the use of mobiles, i.e., make them obsolete. Such a device is known as cell phone jammer or "GSM jammer", which is basically some kind of electronic countermeasure device. The technology behind cell phone jamming is very simple. The jamming device broadcasts an RF signal in the frequency range reserved for cell phones that interferes with the cell phone signal, which results in a "no network available" display on the cell phone screen. All phones within the effective radius of the jammer are silenced. It should be mentioned that cell phone jammers are illegal devices in most countries. According to the Federal Communications Commission (FCC) in the USA: "The manufacture, importation, sale, or offer for sale, of devices designed to block or jam wireless transmissions is prohibited". However, recently, there has been an increasing demand for portable cell phone jammers. We should mention that this project, presented in this report, is solely done for educational purposes. There is no intention to manufacture or sell such devices in Jordan, or elsewhere. In this project, a device that will jam both GSM 900 and GSM 1800 services will be designed, built, and tested.
5
2. Jamming Techniques
There are several ways to jam an RF device. The three most common techniques can be categorized as follows:
1. Spoofing
In this kind of jamming, the device forces the mobile to turn off itself. This type is very difficult to be implemented since the jamming device first detects any mobile phone in a specific area, then the device sends the signal to disable the mobile phone. Some types of this technique can detect if a nearby mobile phone is there and sends a message to tell the user to switch the phone to the silent mode (Intelligent Beacon Disablers).
2. Shielding Attacks
This is known as TEMPEST or EMF shielding. This kind requires closing an area in a faraday cage so that any device inside this cage can not transmit or receive RF signal from outside of the cage. This area can be as large as buildings, for example.
3. Denial of Service
This technique is referred to DOS. In this technique, the device transmits a noise signal at the same operating frequency of the mobile phone in order to decrease the signal-to-noise ratio (SNR) of the mobile under its minimum value. This kind of jamming technique is the simplest one since the device is always on. Our device is of this type.
3. Design Parameters
Based on the above, our device which is related to the DOS technique is transmitting noise on the same frequencies of the two bands GSM 900 MHz, and GSM 1.8 GHz (known also as DCS 1800 band). We focused on some design parameters to establish the device specifications. These parameters are as follows:
1. The distance to be jammed (D)
This parameter is very important in our design, since the amount of the output power of the jammer depends on the area that we need to jam. Later on we will see the relationship between the output power and the distance D. Our design is established upon D=10 meters for DCS 1800 band and D=20 meters for GSM 900 band.
2. The frequency bands
Table 1: Operating frequency bands.
UPLINK
(Handset
transmit)
DOWNLINK
(Handset
receive)
USED IN
JORDAN
BY:
GSM 900
890-915 MHz
935-960 MHz
Zain + Orange
DCS 1800
1710-1785 MHz
1805-1880 MHz
Umniah
In our design, the jamming frequency must be the same as the downlink, because it needs lower power to do jamming than the uplink range and there is no need to jam the base station itself. So, our frequency design will be as follows:
GSM 900 935-960 MHz
GSM 1800 1805-1880 MHz
6
3. Jamming–to-signal ratio {J/S}
Jamming is successful when the jamming signal denies the usability of the communication transmission. In digital communications, the usability is denied when the error rate of the transmission can not be compensated by error correction. Usually, a successful jamming attack requires that the jammer power is roughly equal to signal power at the receiver (mobile device).
The general equation of the jamming-to-signal ratio is given as follows:
where: Pj=jammer power, Gjr= antenna gain from jammer to receiver, Grj=antenna gain from receiver to jammer, Rtr=range between communication transmitter and receiver, Br=communication receiver bandwidth, Lr =communication signal loss, Pt=transmitter power, Gtr= antenna gain from transmitter to receiver, Grt=antenna gain from receiver to transmitter, Rjr=range between jammer and communication receiver, Bj=jammer bandwidth, and Lj=jamming signal loss.
For GSM, the specified system SNRmin is 9 dB which will be used as the worst case scenario for the jammer. The maximum power at the mobile device Pr is -15 dBm.
4. Free space loss {F}
The free-space loss (or path loss) is given by:
The maximum free space loss (worst case F) happens when the maximum frequency is used in the above equation. Using 1880 MHz gives:
F (dB) =32.44+20 log 0.01 + 20 log 1880 which gives F =58 dB.
7
4. System Design
4.1 Power calculations
Here, we need to find the power that is needed to be transmitted to jam any cell phone within a distance of around 10 meters for DCS. From the above considerations, we can find the required output power from the device, as follows:
Using SNR=9 dB and the maximum power signal for mobile receiver=-15 dBm, gives J=-24 dBm. But, our goal is to find the output power from the device, so when we add the free space loss to the amount of power at the mobile receiver we get our target:
Output power=-24dBm+58dB = 34 dBm
[attachment=21327]
Abstract
This report presents the design, implementation, and testing of a dual-band cell-phone jammer. This jammer works at GSM 900 and GSM 1800 simultaneously and thus jams the three well-known carriers in Jordan (Zain, Orange, and Umniah). This project went through two phases:
Phase one: studying the GSM-system to find the best jamming technique, establishing the system design and selecting suitable components.
Phase two: buying all the needed components, drawing the overall schematics, fabricating the PCB layout, assembling the devices, performing some measurements and finally testing the mobile jammer.
The designed jammer was successful in jamming the three carriers in Jordan as will be shown at the end of this report.
4
1. Introduction
Communication jamming devices were first developed and used by military. This interest comes from the fundamental objective of denying the successful transport of information from the sender (tactical commanders) to the receiver (the army personnel), and vice-versa. Nowadays, mobile (or cell) phones are becoming essential tools in our daily life. Here in Jordan, for example, with a rather low population (around 5 million), three main cell phone carries are available; namely; Zain, Orange, and Umniah The first two use the GSM 900 system, while the third uses the GSM 1800 system. Needless to say, the wide use of mobile phones could create some problems as the sound of ringing becomes annoying or disrupting. This could happen in some places like conference rooms, law courts, libraries, lecture rooms and mosques. One way to stop these disrupting ringings is to install a device in such places which will inhibit the use of mobiles, i.e., make them obsolete. Such a device is known as cell phone jammer or "GSM jammer", which is basically some kind of electronic countermeasure device. The technology behind cell phone jamming is very simple. The jamming device broadcasts an RF signal in the frequency range reserved for cell phones that interferes with the cell phone signal, which results in a "no network available" display on the cell phone screen. All phones within the effective radius of the jammer are silenced. It should be mentioned that cell phone jammers are illegal devices in most countries. According to the Federal Communications Commission (FCC) in the USA: "The manufacture, importation, sale, or offer for sale, of devices designed to block or jam wireless transmissions is prohibited". However, recently, there has been an increasing demand for portable cell phone jammers. We should mention that this project, presented in this report, is solely done for educational purposes. There is no intention to manufacture or sell such devices in Jordan, or elsewhere. In this project, a device that will jam both GSM 900 and GSM 1800 services will be designed, built, and tested.
5
2. Jamming Techniques
There are several ways to jam an RF device. The three most common techniques can be categorized as follows:
1. Spoofing
In this kind of jamming, the device forces the mobile to turn off itself. This type is very difficult to be implemented since the jamming device first detects any mobile phone in a specific area, then the device sends the signal to disable the mobile phone. Some types of this technique can detect if a nearby mobile phone is there and sends a message to tell the user to switch the phone to the silent mode (Intelligent Beacon Disablers).
2. Shielding Attacks
This is known as TEMPEST or EMF shielding. This kind requires closing an area in a faraday cage so that any device inside this cage can not transmit or receive RF signal from outside of the cage. This area can be as large as buildings, for example.
3. Denial of Service
This technique is referred to DOS. In this technique, the device transmits a noise signal at the same operating frequency of the mobile phone in order to decrease the signal-to-noise ratio (SNR) of the mobile under its minimum value. This kind of jamming technique is the simplest one since the device is always on. Our device is of this type.
3. Design Parameters
Based on the above, our device which is related to the DOS technique is transmitting noise on the same frequencies of the two bands GSM 900 MHz, and GSM 1.8 GHz (known also as DCS 1800 band). We focused on some design parameters to establish the device specifications. These parameters are as follows:
1. The distance to be jammed (D)
This parameter is very important in our design, since the amount of the output power of the jammer depends on the area that we need to jam. Later on we will see the relationship between the output power and the distance D. Our design is established upon D=10 meters for DCS 1800 band and D=20 meters for GSM 900 band.
2. The frequency bands
Table 1: Operating frequency bands.
UPLINK
(Handset
transmit)
DOWNLINK
(Handset
receive)
USED IN
JORDAN
BY:
GSM 900
890-915 MHz
935-960 MHz
Zain + Orange
DCS 1800
1710-1785 MHz
1805-1880 MHz
Umniah
In our design, the jamming frequency must be the same as the downlink, because it needs lower power to do jamming than the uplink range and there is no need to jam the base station itself. So, our frequency design will be as follows:
GSM 900 935-960 MHz
GSM 1800 1805-1880 MHz
6
3. Jamming–to-signal ratio {J/S}
Jamming is successful when the jamming signal denies the usability of the communication transmission. In digital communications, the usability is denied when the error rate of the transmission can not be compensated by error correction. Usually, a successful jamming attack requires that the jammer power is roughly equal to signal power at the receiver (mobile device).
The general equation of the jamming-to-signal ratio is given as follows:
where: Pj=jammer power, Gjr= antenna gain from jammer to receiver, Grj=antenna gain from receiver to jammer, Rtr=range between communication transmitter and receiver, Br=communication receiver bandwidth, Lr =communication signal loss, Pt=transmitter power, Gtr= antenna gain from transmitter to receiver, Grt=antenna gain from receiver to transmitter, Rjr=range between jammer and communication receiver, Bj=jammer bandwidth, and Lj=jamming signal loss.
For GSM, the specified system SNRmin is 9 dB which will be used as the worst case scenario for the jammer. The maximum power at the mobile device Pr is -15 dBm.
4. Free space loss {F}
The free-space loss (or path loss) is given by:
The maximum free space loss (worst case F) happens when the maximum frequency is used in the above equation. Using 1880 MHz gives:
F (dB) =32.44+20 log 0.01 + 20 log 1880 which gives F =58 dB.
7
4. System Design
4.1 Power calculations
Here, we need to find the power that is needed to be transmitted to jam any cell phone within a distance of around 10 meters for DCS. From the above considerations, we can find the required output power from the device, as follows:
Using SNR=9 dB and the maximum power signal for mobile receiver=-15 dBm, gives J=-24 dBm. But, our goal is to find the output power from the device, so when we add the free space loss to the amount of power at the mobile receiver we get our target:
Output power=-24dBm+58dB = 34 dBm