However, it also states: "A valid SIM card must be registered with the network, as NITZ is a network-provisioned service." So this key ambiguity remains. Maybe the way to approach it is the unofficial one, using an SDR to pick up the RF signals and decoding them to extract the time. More specifically: "Tools like gr-gsm can sniff the Broadcast Control Channel (BCCH) of a tower." So one would need to research that information... "More technical details can be found in the ETSI TR 121 905 V6.7.0 (2004-06) document."
Is this for a commercial product? Then you may be liable for fraudulent obtaining of services. Obtaining the time from a cellular network is a paid service requiring a SIM, and obtaining it via breaking a crypto is a felony.
I think it’s better to use GPS
I think it’s better to use GPS — it provides more precise time and doesn’t depend on network access or a SIM card. Also it has wider coverage...Nope. GPS is very prone to all kinds of attacks. GPS can't be relied on at all for anything critical. Using cell towers is a much more viable approach. It seems Ublox have modules which can get time from LTE towers without needing a SIM card. The dataframes used by LTE to get layer1 going (like sending tower IDs) is not encrypted and AFAIK a timestamp is included in some of the frames.
It looks like NITZ (Network Identity and Time Zone) is a NAS message which is only transmitted after the phone registers to the network, broadcast messages don't contain this information. At least this is what I could find after a bit of searching. Making an emergency call means registering, something you can't do without a SIM card or without making an emergency call.
Obtaining the time from a cellular network is a paid service requiring a SIM, and obtaining it via breaking a crypto is a felony.
SystemInformationBlockType16
The IE SystemInformationBlockType16 contains information related to GPS time and Coordinated Universal Time
(UTC). The UE may use the parameters provided in this system information block to obtain the UTC, the GPS and the
local time.
Over-the-air time synchronization to UTC
The process of synchronizing a 5G device to the absolute 5G network time, typically UTC, is done by direct
messaging over the air interface. 5G uses a simple but accurate method to communicate time of day to
the device. The device (UE) identifies so-called system frames by monitoring the air interface, each with a
system frame number (SFN). Contained within the 5G system information block 9 (SIB9) is the information
related to GPS time and UTC. SIB9 messages are broadcast to inform devices of the exact time at the
boundary between two SFNs. Hence, when the device has locked its internal clock to the system frame
pacing, it can use this message to set its absolute time.
SIB9 contains the time information as well as flags to assist the device to understand the local time
as shown in Figure 6. Reading the SIB9 and acquiring the time-of-day alignment can be performed by
any device even if not subscribed to the 5G service. It only requires a 5G-capable receiver in the device
as SIB9 can be broadcast in the cell. For fully subscribed devices, the network may also provide the
timing information to each device by means of dedicated signaling (using Radio Resource Control (RRC)
messages).
| Generation | Dedicated broadcast UTC/local-time SIB? | Readable before subscription/attach? |
| 5G NR | Yes — SIB9 | Usually yes |
| 4G LTE | Partial / indirect | Some parts yes |
| 3G UMTS | Partial / indirect | Some parts yes |
Your missing sumthing hear
The mobile device is getting its time signal from a base station that using a GPS disciplined oscillator
so while your time is derived from a rubidium reference in the base station that reference is kept in sync with all the other base stations & UTC using the satellite navigation systems.
I'm guessing your point is 'you may as well use gps, because mobile time is gps derived anyway'.Yes
Since the question says "extract a time" it is not clear what "time".