2G Mobile Communication Systems - Technische … Mobile Communication Systems 2G Review: GSM...

2G Mobile Communication Systems2G Review: GSM

ServicesArchitecture ProtocolsCall setupMobility managementSecurity

HSCSD

GPRSArchitectureProtocolsQoS

EDGE

UMTS Networks 2Andreas Mitschele-Thiel 9-May-03

References

Jochen Schiller: Mobile Communications (German and English), Addison-Wesley, 2000(most of the material covered in this chapter is based on the book)

Michel Mouly, Marie-Bernadette Pautet: The GSM System for Mobile Communications. Telecom Pub, Juni 1992

Jörg Eberspaecher, u. a.: GSM Switching, Services and Protocols. John Wiley and Sons Ltd, 2001

Siegmund Redl, u. a.: GSM and Personal Communications Handbook. Artech House, 1998

Gunnar Heine: GSM Networks: Protocols, Terminology, and Implementation. Artech House Mobile Communications Library. Artech House Publishers, 1998


GSM: Overview

formerly: Groupe Spéciale Mobile (founded 1982)

now: Global System for Mobile Communication

Pan-European standard (ETSI, European Telecommunications Standardisation Institute)

simultaneous introduction of essential services in three phases (1991, 1994, 1996) by the European telecommunication administrations

seamless roaming within Europe possible

today many providers all over the world use GSM (more than 170 countries in Asia, Africa, Europe, Australia, America)

more than 700 million subscribers

more than 70% of all digital mobile phones use GSM

in Germany: GSM900 (D1 and D2, 2x25MHz) and DCS1800 (E-plus and O2, 2x75MHz)

over 10 billion SMS per month in Germany, > 200 billion/month worldwide


GSM compared to 1G Systems

Communication mobile, wireless communication; support for voice and data services

Total mobility international access, chip-card enables use of access points of different providers

Worldwide connectivityone number, the network handles localization

High capacity better frequency efficiency, smaller cells, more customers per cell

High transmission qualityhigh audio quality and reliability for wireless, uninterrupted phone calls at higher speeds (e.g. from cars, trains, etc.)

Security functions access control, authentication via chip-card (SIM) and PIN


GSM: Mobile Services

GSM offersseveral types of connections

voice connectionsdata connectionsshort message service

multi-service options (combination of basic services)

Three service domainsBearer ServicesTeleservicesSupplementary Services

transitnetwork

(PSTN, ISDN)

source/destination

networkTE

R, S (U, S, R)Um

MT

MSbearer services

GSM-PLMN TE

teleservicesPLMN: Public Land Mobile NetworkPSTN: Public Switched Telephone NetworkISDN: Integrated Services Digital Network

MS: Mobile StationMT: Mobile Termination (radio-specific part)TE: Terminal


Bearer Services

Telecommunication services to transfer data between access points

Specification of services up to the terminal interface (OSI layers 1-3)

Different data rates for voice and data (original standard)

data service (circuit switched)

synchronous: 2.4, 4.8 or 9.6 kbit/s

asynchronous: 300 - 1200 bit/s

data service (packet switched)

synchronous: 2.4, 4.8 or 9.6 kbit/s

asynchronous: 300 - 9600 bit/s


Teleservices

Telecommunication services that enable voice communication via mobile phones

mobile telephonyprimary goal of GSM was to enable mobile telephony offering the traditional bandwidth of 3.1 kHz emergency numbercommon number throughout Europe (112); mandatory for all serviceproviders; free of charge; connection with the highest priority (preemption of other connections possible)multinumberingseveral ISDN phone numbers per user possible

Non-Voice Teleservicesgroup 3 faxvoice mailbox (implemented in the GSM network)Short Message Service (SMS)alphanumeric data transmission to/from the mobile terminal using the signaling channel, thus allowing simultaneous use of basic services and SMS


Supplementary services

Services in addition to the basic services

cannot be offered stand-alone

similar to ISDN services besides lower bandwidth due to the radio link

may differ between different service providers, countries and protocol versions

Important services

identification: forwarding of caller number

suppression of number forwarding

automatic call-back

conferencing with up to 7 participants

locking of the mobile terminal (incoming or outgoing calls)

...


Architecture of the GSM system

GSM is a PLMN (Public Land Mobile Network)several providers setup mobile networks following the GSM standard within each country

GSM system comprises 3 subsystemsRSS (radio subsystem): covers all radio aspects

MS (mobile station)BSS ( base station subsystem)

BTS (base transeiver station)BSC (base station controller

NSS (network and switching subsystem): call forwarding, handover, switching

MSC (mobile switching center)LR (location register): HLR and VLR

OSS (operation subsystem): management of the networkOMC (operation and maintenance centre)AuC (Authentication centre)EIR (Equipment indentity register)


GSM: overview

MSC MSC

GMSC

OMC, EIR, AUC

VLR

HLR

VLR

fixed networkNSSwith OSS

BSC

BSC

RSS


GSM: elements and interfaces

NSS

MS MS

BTS

BSC

GMSC

IWF

OMC

BTS

BSC

MSC MSC

Abis

Um

EIR

HLR

VLR VLR

A

BSS

PDN

ISDN, PSTN

RSS

radio cell

radio cell

MS

AUCOSS

signaling

O


GSM: system architecture

radiosubsystem

Um

Abis

ABSS

BTSBSC

BTS

MS MS

BTSBSC

BTS

network and switching subsystem

fixedpartner networks

MSC

MSCIWF

ISDNPSTN

SS7

EIR

HLR

VLR

ISDNPSTN

PS-PDNCS-PDN


System architecture: radio subsystem

ComponentsMS (Mobile Station)BSS (Base Station Subsystem):consisting of

BTS (Base Transceiver Station):sender and receiverBSC (Base Station Controller):controlling several transceivers

InterfacesUm: radio interfaceAbis: standardized, open interface with 16 kbit/s user channelsA: standardized, open interface with 64 kbit/s user channels

Um

Abis

A

BSS

radiosubsystem

network and switchingsubsystem

MS MS

BTSBSC MSC

BTS

BTSBSC

BTSMSC


System architecture: network and switching subsystem

Components• MSC (Mobile Services Switching

Center):• IWF (Interworking Functions)

• ISDN (Integrated Services Digital Network)

• PSTN (Public Switched Telephone Network)

• PS-PDN (Packet Switched Public Data Network)

• CS-PDN (Circuit Switched Public Data Network)

Databases• HLR (Home Location Register)• VLR (Visitor Location Register)• EIR (Equipment Identity Register)

networksubsystem

MSC

MSC

fixed partnernetworks

IWF

ISDNPSTN

PS-PDNCS-PDN

SS7

EIR

HLR

VLR

ISDNPSTN


Radio subsystem

The Radio Subsystem (RSS) comprises the cellular mobile network up to the switching centers

ComponentsBase Station Subsystem (BSS):

Base Transceiver Station (BTS) radio components including sender, receiver, antenna one BTS can cover several cells

Base Station Controller (BSC)switching between BTSs, controlling BTSs, managing of network resources, mapping of radio channels (Um) onto terrestrial channels (A interface)

BSS = BSC + sum(BTS) + interconnectionMobile Stations (MS)


GSM: cellular network

segmentation of the area into cells

cell

possible radio coverage of the cell

idealized shape of the cell

use of several carrier frequenciesnot the same frequency in neighboring cellscell sizes vary from some 100 m up to 35 km depending on user density, geography, transceiver power etc.hexagonal shape of cells is idealized (cells overlap, shapes depend on geography)if a mobile user changes cells-> handover of the connection to the neighbor cell


Example coverage of GSM networks (www.gsmworld.com)

Vodafone (GSM-900/1800)T-Mobile (GSM-900/1800) Berlin

e-plus (GSM-1800) O2 (GSM-1800)


Base Transceiver Station and Base Station Controller

Tasks of a BSS are distributed over BSC and BTS

BTS comprises radio specific functions

BSC is the switching center for radio channels

Functions BTS BSCManagement of radio channels XFrequency hopping (FH) X XManagement of terrestrial channels XMapping of terrestrial onto radio channels XChannel coding and decoding XRate adaptation XEncryption and decryption X XPaging X XUplink signal measurements XTraffic measurement XAuthentication XLocation registry, location update XHandover management X


Mobile station

Terminal for the use of GSM servicesA mobile station (MS) comprises several functional groups

MT (Mobile Termination):offers common functions used by all services the MS offerscorresponds to the network termination (NT) of an ISDN accessend-point of the radio interface (Um)

TA (Terminal Adapter):terminal adaptation, hides radio specific characteristics

TE (Terminal Equipment):peripheral device of the MS, offers services to a userdoes not contain GSM specific functions

SIM (Subscriber Identity Module):personalization of the mobile terminal, stores user parameters

R S UmTE TA MT


Network and switching subsystem

NSS is the main component of the public mobile network GSMswitching, mobility management, interconnection to other networks, system control

ComponentsMobile Services Switching Center (MSC)controls all connections via a separated network to/from a mobile terminal within the domain of the MSC - several BSC can belong to a MSCDatabases (important: scalability, high capacity, low delay)

Home Location Register (HLR)central master database containing user data, permanent and semi-permanent data of all subscribers assigned to the HLR (one provider can have several HLRs)Visitor Location Register (VLR)local database for a subset of user data, including data about all user currently in the domain of the VLR


Mobile Services Switching Center (MSC)

The MSC plays a central role in GSMswitching functionsadditional functions for mobility supportmanagement of network resourcesinterworking functions via Gateway MSC (GMSC)integration of several databases

Functions of a MSC

specific functions for paging and call forwardingtermination of SS7 (signaling system no. 7)mobility-specific signalinglocation registration and forwarding of location informationprovision of new services (fax, data calls)support of short message service (SMS)generation and forwarding of accounting and billing information


Operation subsystem

The OSS (Operation Subsystem) enables centralized operation, management, and maintenance of all GSM subsystems

Components

Authentication Center (AUC)generates user specific authentication parameters on request of a VLR

authentication parameters used for authentication of mobile terminals and encryption of user data on the air interface within the GSM system

Equipment Identity Register (EIR)registers GSM mobile stations and user rights

stolen or malfunctioning mobile stations can be locked and sometimes even localized

Operation and Maintenance Center (OMC)different control capabilities for the radio subsystem and the network subsystem


GSM: Air Interface

FDMA (Frequency Division Multiple Access) / FDD (Frequency Division Duplex)

1 2 3 123124. . .

890 MHz 915 MHz

1 2 3 123124. . .

935 MHz 960 MHz

200 kHz

Uplink Downlink

frequency

TDMA (Time Division Multiple Access)

time

Downlink

87654321

4,615 ms = 1250 bit

Uplink

87654321


GSM: Voice Coding

Voice coding Framing Modulation(GMSK)

64-1

04 k

bps

9,6

kbps

Channelcoding

22,8

kbp

s

Framing

33,8

kbp

s

(270

,8 k

bps)

Modulation(GMSK)

114 + 42 bit

Guard (8.25 bits): avoid overlap with other time slots (different time offset of neighboring slot)Training sequence: select the best radio path in the receiver and train equalizerTail: needed to enhance receiver performanceFlag S: indication for user data or control data

1 2 3 4 5 6 7 8GSM TDMA frame

GSM time-slot (normal burst)

4.615 ms

546.5 µs577 µs

tail user data TrainingSguardspace S user data tail

guardspace

3 bits 57 bits 26 bits 57 bits1 1 3

114 bit/slot


GSM hierarchy of frames

slot

superframe

120 ms

6.12 s

traffic multiframe

0 1 24 25...

0 1 2 48 49 50... 235.4 mscontrol multiframe

0 1 24 25...

2045 2046hyperframe 3 h 28 min 53.76 s0 1 2 ... 2047

0 1 2 ... 48 49 50

frame 4.615 ms0 1 ... 6 7

577 µsburst

traffic multiframe: 24 frames (22.8 kbps) used for traffic channel (user data), or fast signaling

1 frame (950 bps) used for slow signaling, 1 frame unused


GSM protocol layers for signaling

CM

MM

RR

MM

LAPDm

radio

LAPDm

radio

LAPD

PCM

RR’ BTSM

CM

LAPD

PCM

RR’BTSM

16/64 kbit/s

Um Abis A

SS7

PCM

SS7

PCM

64 kbit/s /2.048 Mbit/s

MS BTS BSC MSC

BSSAP BSSAP

CM: call managementMM: mobility managementRR: radio resource managmentLAPDm: link access procedure for D-channel (HDLC variant – reliable transport)


Mobile Terminated Call (MTC)

PSTNcallingstation GMSC

HLR VLR

BSSBSSBSS

MSC

MS

1 2

3

4

5

6

7

8 9

10

11 12

1316

10 10

11 11 11

14 15

17

1: calling a GSM subscriber2: forwarding call to GMSC3: signal call setup to HLR4, 5: request MSRN from VLR6: forward responsible

MSC to GMSC7: forward call to

current MSC8, 9: get current status of MS10, 11: paging of MS12, 13: MS answers14, 15: security checks16, 17: set up connection


Mobile Originated Call (MOC)

PSTN GMSC

VLR

BSS

MSC

MS1

2

6 5

3 4

9

10

7 8

1, 2: connection request3, 4: security check5-8: check resources (free circuit)9-10: set up call


MS-BTS signaling details (MTC/MOC)

BTSMS

paging request

channel request

immediate assignment

paging response

authentication request

authentication response

ciphering command

ciphering complete

setup

call confirmed

assignment command

assignment complete

alerting

connect

connect acknowledge

data/speech exchange

BTSMS

channel request

immediate assignment

service request

authentication request

authentication response

ciphering command

ciphering complete

setup

call confirmed

assignment command

assignment complete

alerting

connect

connect acknowledge

data/speech exchange

MTC MOC


4 types of handover

MSC MSC

BSC BSCBSC

BTS BTS BTSBTS

MS MS MS MS

12 3 4


Handover decision

receive levelBTSold

receive levelBTSnew

MS MS

HO_MARGIN

BTSold BTSnew


Handover procedure (change of BSC)

„Make-before-break“ strategy

HO access

BTSold BSCnew

measurementresult

BSCold

Link establishment

MSCMSmeasurementreport

HO decisionHO required

BTSnew

HO request

resource allocationch. activation

ch. activation ackHO request ackHO commandHO commandHO command

HO completeHO completeclear commandclear command

clear complete clear complete

make

break


Security in GSM

Security servicesaccess control/authentication

user ⌫ SIM (Subscriber Identity Module): secret PIN (personal identification number)SIM ⌫ network: challenge response methodno authentication of network!

confidentialityvoice and signaling encrypted on the wireless link (after successful authentication)

anonymitytemporary identity TMSI (Temporary Mobile Subscriber Identity)newly assigned at each new location update (LUP)encrypted transmission

3 algorithms specified in GSMA3 for authentication (“secret”, open interface)A5 for encryption (standardized)A8 for key generation (“secret”, open interface)

“secret”:• A3 and A8

available via the Internet

• network providers can use stronger mechanisms


GSM - authentication

SIMmobile network

A3

RANDKi

128 bit 128 bit

A3

RAND Ki

128 bit 128 bit

SRES 32 bit

SRES* =? SRES SRES

RAND

32 bit

AuC

SIMSRES* 32 bit

SRESMSC

Ki: individual subscriber authentication key SRES: signed response


GSM - key generation and encryption

MS with SIMmobile network (BTS)

A8

RANDKi

128 bit 128 bit

A8

RAND Ki

128 bit 128 bit

RAND

AuC SIM

A5

data

Kc64 bit

SRES

A5

data

cipherkey Kc

64 bit

encrypteddataBTS MS


GSM Evolution – Overview

adaptivemodulation

EDGE

diversity

space

time

Macro diversity

Intelligent antennas

Equalizer

adaptiveredundancyinterference GPRS

aperiodic

HSCSD

continuous

Interference cancelation (multi-user detection)

Spectraleffiency

Dynamicchannel

allocation

Frequencyhopping

Datatraffic


2G+: GSM Evolution

Limits of GSMlimited capacity at the air interface:data transmission standardized with only 9.6 kbit/s

advanced coding allows 14,4 kbit/snot enough for Internet and multimedia applications

=> EDGEinappropriateness for aperiodic and non-symmetrical data traffic

=> GPRS

ExtensionsHSCSD (High-Speed Circuit Switched Data)GPRS (General Packet Radio Service)EDGE (Enhanced Data Rate for GSM Evolution)EGPRS (EDGE und GPRS)GERAN (GSM Interface to UMTS)


HSCSD (High-Speed Circuit Switched Data)

continuous use of multiple time slots

asynchronous allocation of time slots

gain: net data rate up to 115,2 kbps (allocation of all 8 traffic channels)

mainly software update

additional HW needed if more than 3 slots are used

Downlink

71 2 3 84 5 6 1 2

Uplink

71 2 3 84 5 6 1 2


GPRS (General Packet Radio Service)

packet switchingusing free slots only if data packets are ready to send (e.g., 115 kbit/s using 8 slots temporarily)standardization 1998, introduction 2001advantage: first step towards UMTS, flexible data services

GPRS network elementsGSN (GPRS Support Nodes): GGSN and SGSNGGSN (Gateway GSN)

interworking unit between GPRS and PDN (Packet Data Network)SGSN (Serving GSN)

supports the MS (location, billing, security)HLR (GPRS Register – GR)

maintains location and security information


GPRS architecture and interfaces

connection-orientedpacket switched core

MS BSS GGSNSGSN

MSC

Um

EIR

HLR/GR

VLR

PDN

Gb Gn Gi

SGSN

Gn


GPRS protocol architecture

appl.

IP/X.25

LLC

GTP

MAC

radio

MAC

radioFR

RLC BSSGP

IP/X.25

FR

Um Gb Gn

L1/L2 L1/L2

MS BSS SGSN GGSN

UDP/TCP

Gi

SNDCP

RLC BSSGP IP IP

LLC UDP/TCPSNDCP GTP


GPRS services

Quality-of-Service Parametersreliabilitydelay (delay class 1: 95%-delay < 1.5-7 sec. depending on packet size)throughputservice priority

Reliabilityclass

Lost SDUprobability

DuplicateSDU

probability

Out ofsequence

SDUprobability

Corrupt SDUprobability

1 10-9 10-9 10-9 10-9

2 10-4 10-5 10-5 10-6

3 10-2 10-5 10-5 10-2

Delay SDU size 128 byte SDU size 1024 byteclass mean 95 percentile mean 95 percentile

1 < 0.5 s < 1.5 s < 2 s < 7 s2 < 5 s < 25 s < 15 s < 75 s3 < 50 s < 250 s < 75 s < 375 s4 unspecified


GPRS services

End-to-End packet switched traffic (peak channel rates)28 kbps (full use of 3 time slots, CS-1: FEC) 171.2 kbps (full use of 8 time slots, CS-4: no FEC)

Average aggregate throughput of a cell (Source: H. Menkes, WirelessWeb, Aug. 2002)

95 kbps (for both up and downlink)Assumptions: 4/12 reuse, realistic RF conditions, random traffic

Worse figures for individual TCP traffic

Adaptive Coding Schemes (adaptive Forward Error Control – FEC)CS 1: 9.05 Kbps/slotCS 2: 13.4 Kbps/slotCS 3: 15.6 Kbps/slotCS 4: 21.4 Kbps/slot (no Forward Error Correction)

(current systems implement CS1 and 2 only)

Problems and limitsIP-based network => high latency, no guaranteesLimited data rate: 28 kbps (3 slot/CS-1) - 64.2 kbps (3 slot/CS-4)Latency/flow control problems with TCP


EDGE (Enhanced Data Rates for GSM Evolution)

Spectral efficiency depends on:Size of frequency bandDuration of usageLevel of interference to others (power)

EDGE:

Adaptation of modulation depending on quality of radio path

GMSK (GSM standard – 1 bit per symbol)8-PSK (3 bits per symbol)

Adaptation of coding scheme depending on quality of radio path (9 coding schemes)

Gain: data rate (gross) up to 69,2kbps (compare to 22.8kbps for GSM)

complex extension of GSM!

Near-far problem

NodeBNodeB

UE 1UE 1

UE 2UE 2


Preview: UMTS system architectur (Release 3)

GSM Radio Access Network(circuit switched)

f1

f2

f4

f3

f6

f5

f7BSC

BTS

BSC

3G GMSC

BTS

3G MSC

HLR VLR AC EIR

ISDN

ISP

ISP

Core Network (packet switched)

3G SGSN

3G SGSN

3G GGSN

c4

c3

c5

c1

c2

UMTS Radio Access Network

RNCnodeB

RNCnodeB

Core Network(circuit switched)

3G MSC

2G Mobile Communication Systems - Technische … Mobile Communication Systems 2G Review: GSM...

Documents

Transcript of 2G Mobile Communication Systems - Technische … Mobile Communication Systems 2G Review: GSM...