在台灣登山客受困山區的新聞時有所聞，搜尋受困登山客也十分困難；同樣地受困於地震倒塌樓房的民眾，搜尋難度也十分地高，若是使用行動電話定位則可以降低搜救的困難度。然而國內的行動定位設備採購，皆是單價昂貴的外國產品，並非所有相關救災單位都有能力採購類似的設備。行動電話定位的技術門檻頗高，如果可以用成本較低的設備完成相同功能，那麼對於相關救災單位採購的財務壓力也可降低，同時也可以加強搜救能力。所以本論文所探討的問題便是如何以低成本的系統達到行動電話定位的功能。
透過這個題目的研究，我們可以充分理解手機定位的理論，以及定位系統實作的原理。對於未來國內廠商若有意願開發自己的手機定位產品，這個題目的研究是一個很好的開始。
為了符合低成本的需求，我們必須研究一些開放源碼軟體的專案，如OpenBTS、GSM-Receiver，以及3GPP定位相關(Location Service、RRLP)的規格。由於這些開放源碼軟體並非都是完好發展的軟體，存在著許多錯誤以及漏洞，所以我們必須了解每一專案的架構與功能並解決部分錯誤，才有辦法達成定位的功能。另外如何解決定位的精準度也是一大挑戰。
本論文剖析OpenBTS以及GSM-Receiver的系統架構，並提出如何利用OpenBTS來達成定位功能，以及如何利用OpenBTS的移動來提高定位的精準度。對於未來發展定位產品具有參考的價值。

In Taiwan, the events of the mountain climbers trapped in the mountain were heard time to time, and it is quite difficult to search the climber in the mountain; so are the people trapped in the collapsed building in the earthquake. But it would be easier if we use mobile phone positioning system to search the people in such scenario. But such mobile phone positioning system in Taiwan are all imported and expensive, not all emergency relief department can afford. If we can use cost effective way to achieve the same function, then the emergency relief department can enchance the capability of rescue without financial burden, hence the target in question in this paper is how to achieve mobile phone positioning with cost efficiency system.
Through the study of this subject, we can fully understand the theory of mobile phone positioning, and the principle of how positioning system implements. This research would be a good start if there is any domestic manufacture would like to develop their own mobile phone positioning products.
In order to meet the needs of cost efficiency, we must study a number of open source software projects, such as OpenBTS, GSM-Receiver, and 3GPP specifications(Location Service, RRLP). Besides to understand the functions and structures of these open source software, as there are bugs exist in these open source software, we also have to solve some bugs to achieve the positioning function. In addition, the accuracy of positioning is also a major challenge.
This paper analyzed the system architecture of OpenBTS and GSM-Receiver, and proposed how to achieve mobile phone positioning with OpenBTS system, and how to improve the positioning accuracy with properly delployemnt of the OpenBTS system, which can be a reference of how to develop mobile positioning system.

[1] OpenBTS. Available: http://wush.net/trac/rangepublic/wiki
[2] Aiprobe Project home page. Available:
https://svn.berlin.ccc.de/projects/airprobe/
[3] OpenBSC home page. Available: http://openbsc.osmocom.org/trac/
[4] RangeNetworks Co.. Available: http://www.rangenetworks.com/about/
[5] A. Rahmati and Z. H. Shahi,“Passive localization scheme via the monitoring system in air interface of cellular networks,” 2011 UKSim 13th International Conference on Modelling and Simulation.
[6] P. Skokowski, K. Kanciak, and J. Lopatka, “Passive analysis of non-cooperative GSM signals,” International Conference on Signal Processing and Communication Systems, (ICSPCS), 2009.
[7] Fabian van den Broek, “Eavesdropping on GSM: state-of-affairs,” in Proceeding of the 5th Benelux Workshop on Information and System Security (WISSec2010), pp.1-16, Nov. 2010.
[8] Ettus USRP N210, Available:
http://www.ettus.com/content/files/kb/Ettus_Networked_Series.pdf
[9] “Silent SMS: How I know where you were yesterday night? ”. Available: http://www.ivizsecurity.com/blog/security-awareness/silent-sms-how-i-know-where-you-were-yesterday-night/
[10] 3GPP TS 03.71, “Location Services (LCS); Functional description; Stage 2.”
[11] 3GPP TS 44.031, “Digital cellular telecommunications system (Phase 2+); Location Services (LCS); Mobile Station (MS) - Serving Mobile Location Centre (SMLC); Radio Resource LCS Protocol (RRLP).”
[12] ITU ASN.1 Project. Available:
https://www.itu.int/ITU-T/asn1/introduction/index.htm
[13] Wireshark. Available: http://www.wireshark.org/
[14] GNURadio. Available: http://gnuradio.org/redmine/
[15] 3GPP TS 05.03, “Digital cellular telecommunications system (Phase 2+); Channel coding.”
[16] RRLP Server. Available: http://wush.net/trac/rangepublic/wiki/rrlp
[17] Asterisk home page. Available: http://www.asterisk.org/
[18] A. Dhananjay, M. Tierney, J. Li and L. Subramanian, “WiRE: a new rural connectivity paradigm,” Proceedings of the ACM SIGCOMM 2011, pp.462-463.
[19] M. Cabral, I. Almeida, C. Melo and A. Klautau, “Low-cost GSM telephony in the Amazon region based on open-source/open-hardware project,” LATINCOM, 2009.
[20] E. Natalizio, V. Loscri, G. Aloi, N. Paoli, and N. Barbaro, “The practical experience of implementing a GSM BTS through Open Software/Hardware,” Proceedings of ISABEL, Rome, November 8-10, 2010.
[21] 3GPP TS 05.01, “Digital cellular telecommunications system (Phase 2+); Physical Layer on the Radio Path (General Description).”
[22] 3GPP TS 05.02, “Digital cellular telecommunications system (Phase 2+); Multiplexing and Multiple Access on the Radio Path.”
[23] Erlang Programming Language, Available: http://www.erlang.org/
[24] DEFINITION OF A YUMA ALMANAC. Available:
http://www.navcen.uscg.gov/?pageName=gpsYuma
[25] RINEX: The Receiver Independent Exchange Format Version 2.10. Available: http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
[26] GSMTAP Protocol. Available: http://bb.osmocom.org/trac/wiki/GSMTAP
[27] 顏允廷, “利用移動式基地台提昇無線定位效能,” 國立中山大學電機工程學系碩士論文,2009.