2G Mobile Communication Systems - tu-ilmenau.de · 2G Mobile Communication Systems 2G Review: GSM...

2G Mobile Communication Systems 2G Review: GSM

Services Architecture Protocols Call setup Mobility management Security

HSCSD

GPRS Architecture Protocols QoS

EDGE

UMTS Networks 2Andreas Mitschele-Thiel, Jens Mückenheim Oct-08

References

Jochen Schiller: Mobile Communications (German and English), Addison-Wesley, 2000(most of the material covered in this chapter is based on the book)

Michel Mouly, Marie-Bernadette Pautet: The GSM System for Mobile Communications. Telecom Pub, Juni 1992

Jörg Eberspaecher, u. a.: GSM Switching, Services and Protocols. John Wiley and Sons Ltd, 2001

Siegmund Redl, u. a.: GSM and Personal Communications Handbook. Artech House, 1998

Gunnar Heine: GSM Networks: Protocols, Terminology, and Implementation. Artech House Mobile Communications Library. Artech House Publishers, 1998


GSM - Global System for Mobile Communication Pan-European standard

(set by ETSI, European Telecommunications Standardisation Institute) simultaneous introduction of essential services in three phases (1991, 1994,

1996) by the European telecommunication administrations seamless roaming within Europe and worldwide via multimode terminals

GSM is one of the fastest growing communications technology of all time The billionth GSM user was connected in Q1 2004 - just a dozen years after the

commercial launch of the first GSM networks [Projection in 1989: 13 million subscribers in Europe in 2005]

The second billionth GSM user was connected in Q2 2006 - just two and a half years after the first billion

GSM accounts for 82% of the global mobile market (2007) 29% of the global population use GSM technology (2007) The GSM Association (www.gsmworld.com ) currently has operator members in

218 countries and territories. in Germany (2007): 81 mio subscribers in 4 networks:

T-Mobile (D1) and Vodafone (D2), E-plus and O2 23 billion SMS per year (350 SMS per user per year)

o


1982 GSM was created as Groupe Spéciale Mobile within CEPT1986 Permanent nucleus was set up ( Edition and updating of

recommendations)1987 Main radio transmission techniques chosen based on prototype

evaluation.1989 GSM becomes an ETSI Technical Committee.1990 The phase 1 GSM 900 specifications ( drafted 1987-90) were frozen.

DCS 1800 adaptation starts.1991 First systems started running (Telecom 1991 exhibition).

DCS 1800 specifications frozen.1992 All major European GSM 900 operators begin commercial operation.1997 HSCSD specs1998 GPRS specs99/00 EDGE specs

GSM STANDARD DEVELOPMENT MILESTONES

o


GSM compared to 1G Systems

Communication mobile, wireless communication; support for voice and data services

Total mobility international access, chip-card enables use of access points of

different providersWorldwide connectivity one number, the network handles localization

High capacity better frequency efficiency, smaller cells, more customers per cell

High transmission quality high audio quality and reliability for wireless, uninterrupted phone

calls at higher speeds (e.g. from cars, trains, etc.) by digital transmission

Security functions access control, authentication via chip-card (SIM) and PIN

o


GSM – Technical characteristics

Frequency Division Duplex (FDD) for Uplink and Downlink Carrier bandwidth: 200kHz GSM900 MHz (EU):

UL 890–915 MHz, DL 935–960 MHz (2 x 25 MHz) Duplex spacing is 45 MHz. This 25 MHz bandwidth is subdivided into 124 carrier frequency channels (of 200 kHz) in addition GSM-R (railways), E-GSM (extended band) at 900 Mhz, GSM400 at 400 MHz etc.

DCS1800 MHz (EU): UL 1710-1785, DL 1805-1880 (2 x 75 MHz) Duplex spacing is 95 MHz. This 75 Mhz bandwidth is subdivided in 374 carrier frequency channels (of 200 kHz) in addition GSM-1900 (USA)

Time Division Multiplex for Uplink and Downlink: each 200 KHz channel is divided into 8 timeslots duration of a timeslot 4.615 ms basic channel data rate is 270.8 kbit/s (270/8 = 34 kb/s per timeslot) GMSK Modulation A time slot can carry various logical channels:

broadcast channel (in DL), random access channel (in UL) „slow“ and „fast“ dedicated control channels traffic channel (speech)

Transmission power in the handset < 2 watts in GSM850/900 and < 1 watt in GSM1800/1900.

o


GSM: Mobile Services

GSM offers several types of connections

voice connections data connections short message service

multi-service options (combination of basic services)Three service domains (a “mobile” model of ISDN) Bearer Services Teleservices Supplementary Services

GSM-PLMNtransit

network(PSTN, ISDN)

source/destination

networkTE TE

bearer services

teleservices

R, S (U, S, R)Um

MT

MS

PLMN: Public Land Mobile NetworkPSTN: Public Switched Telephone NetworkISDN: Integrated Services Digital Network

MS: Mobile StationMT: Mobile Termination (radio-specific part)TE: Terminal

o


Bearer Services

Telecommunication services to transfer data between access points

Specification of services up to the terminal interface (OSI layers 1-3)

Different data rates for voice and data (original standard)

data service (circuit switched)

synchronous: 2.4, 4.8 or 9.6 kbit/s

asynchronous: 300 - 1200 bit/s

data service (packet switched) –> superseded by GPRS

synchronous: 2.4, 4.8 or 9.6 kbit/s

asynchronous: 300 - 9600 bit/s


Teleservices

Telecommunication services that enable voice communication via mobile phones mobile telephony

primary goal of GSM was to enable mobile telephony offering nearly ISDN quality (bandwidth of 7 kHz); Today: Fullrate codec (FR–13kb/s), halfrate (HR-5.6kb/s), Enhanced Fullrate (EFR-

12.2kb/s)

emergency numbercommon number throughout Europe (112); mandatory for all service providers; free of charge; connection with the highest priority (preemption of other connections possible)

multinumberingseveral ISDN phone numbers per user possible

Non-Voice Teleservices group 3 fax voice mailbox (implemented in the GSM network) Short Message Service (SMS)

alphanumeric data transmission to/from the mobile terminal using the signaling channel, thus allowing simultaneous use of basic services and SMS


Supplementary services

Services in addition to the basic services

cannot be offered stand-alone

similar to ISDN services besides lower bandwidth due to the radio link

may differ between different service providers, countries and protocol versions

Important services

call forwarding

identification: forwarding of caller number

suppression of number forwarding (CLIP, CLIR)

automatic call-back

conferencing with up to 7 participants

locking of the mobile terminal (incoming or outgoing calls)

...


Architecture of the GSM system

GSM is a PLMN (Public Land Mobile Network) several providers setup mobile networks following the GSM standard

within each country

GSM system comprises 3 subsystems

RSS (radio subsystem): covers all radio aspectsMS (mobile station) BSS (base station subsystem) or RAN (radio access network)

BTS (base transeiver station) BSC (base station controller)

NSS (network and switching subsystem): call forwarding, handover, switchingMSC (mobile services switching center) LR (location register): HLR and VLR

OSS (operation subsystem): management of the networkOMC (operation and maintenance centre) AuC (authentication centre) EIR (equipment identity register)


GSM: overview

fixed network

BSC

BSC

MSC MSC

GMSC

OMC, EIR, AUC

VLR

HLRNSSwith OSS

RSS

VLR

BTS BTSBTS BSC: n:1 (tree)BSC MSC: n:1 (tree)MSC – VLR: 1:1MSC – MSC : meshed network


GSM: elements and interfaces

NSS

MS MS

BTS

BSC

GMSC

IWF

OMC

BTS

BSC

MSC MSC

Abis

Um

EIR

HLR

VLR VLR

A

BSS

PDN

ISDN, PSTN

RSS

radio cell

radio cell

MS

AUCOSS

signaling

O

Um Interface (MS and BTS):radio, air interface

Abis Interface (BTS and BSC)

Interfaces B,...,H within NSS (between MSC, VLR and HLR)

A Interface (BSC and MSC)


MSC

SMSC

GMSC

EIRAUC

MAP/B

MSC

MAP/E

VLR

VLRMAP/B

MAP/G

HLRMAP/IMAP/D

MAP/H

MAP/C

Mobile Application Part (MAP) and Interfaces

MAP Functions: MAP supports necessary communication between MSC, GMSC, SMSC, HLR, VLR and

EIR. Transports location information. Transports authentication information. Transports subscription information Transports inter MSC handover information to HLR/VLR.

o


Um

Abis

ABSS

radio subsystem (RSS)

MS MS

BTSBSC

BTS

BTSBSC

BTS

network and switching subsystem (NSS)

MSC

MSC

fixedpartner networks

IWF

ISDNPSTN

PS-PDNCS-PDN

SS7

EIR

HLR

VLR

ISDNPSTN

GSM: system architecture

o


System architecture: network and switching subsystem

Components• MSC (Mobile Services Switching

Center):• IWF (Interworking Functions)

• ISDN (Integrated Services Digital Network)

• PSTN (Public Switched Telephone Network)

• PS-PDN (Packet Switched Public Data Network)

• CS-PDN (Circuit Switched Public Data Network)

Databases• HLR (Home Location Register)• VLR (Visitor Location Register)• EIR (Equipment Identity Register)

network & switch.subsystem

MSC

MSC

fixed partner networks

IWF

ISDNPSTN

PS-PDNCS-PDN

SS7

EIR

HLR

VLR

ISDNPSTN

o


System architecture: radio subsystem

Components MS (Mobile Station) BSS (Base Station Subsystem):

consisting of BTS (Base Transceiver Station):

sender and receiver BSC (Base Station Controller):

controlling several transceiversInterfaces

Um: radio interface Abis: standardized, open interface with

16 kbit/s user channels A: standardized, open interface with

64 kbit/s user channels

Um

Abis

A

BSS

radiosubsystem

network and switchingsubsystem

MS MS

BTSBSC MSC

BTS

BTSBSC

BTSMSC

o


Radio subsystem

The Radio Subsystem (RSS) comprises the cellular mobile network up to the switching centers

Components Base Station Subsystem (BSS):

Base Transceiver Station (BTS) radio components including sender, receiver, antenna one BTS can cover several cells

Base Station Controller (BSC) switching between BTSs, controlling BTSs, managing of network resources, mapping of radio channels (Um) onto terrestrial channels (A

interface)BSS = BSC + sum(BTS) + interconnection

Mobile Stations (MS)


possible radio coverage of the cell

idealized shape of the cellcell

segmentation of the area into cells

GSM: cellular network

use of several carrier frequencies not the same frequency in neighboring cells cell radius varies from some 100 m up to 35 km depending on

user density, geography, transceiver power etc. hexagonal shape of cells is idealized (cells overlap, shapes depend

on geography) if a mobile user changes cells

-> handover of the connection to the neighbor cell


Cellular systems: Frequency planning IFrequency reuse only with a certain distance between the base stations

Typical (hexagon) model:

reuse-3 cluster: reuse-7 cluster:

Other regular pattern: reuse-19 the frequency reuse pattern determines the experienced CIR Fixed frequency assignment (default):

certain frequencies are assigned to a certain cell problem: different traffic load in different cells

Dynamic frequency assignment: base station chooses frequencies depending on the frequencies already used in

neighbor cellsFrequency Hopping (fixed or random sequence of frequencies)

Improves quality for slow moving or stationary users (frequency diversity) Reduces impact of intercell interference by statistical averaging

f4f5

f1f3

f2

f6

f7

f4f5

f1f3

f2

f6

f7

f4f5

f1f3

f2

f6

f7f2

f1f3

f2

f1f3

f2

f1f3


Cellular systems: frequency planning II

f1f2

f3f2

f1

f1

f2

f3f2

f3f1

f2f1

f3f3

f3f3

f3

f4f5

f1f3

f2

f6

f7

f3f2

f4f5

f1f3

f5f6

f7f2

f2

f1f1 f1f2f3

f2f3

f2f3h1

h2h3g1

g2

g3

h1h2h3g1

g2

g3g1

g2

g3

3 cell cluster

7 cell cluster

3 cell clusterwith 3 sector antennas


Example coverage of GSM networks (www.gsmworld.com)

e-plus (GSM-1800)

T-Mobile (GSM-900/1800) Berlin

O2 (GSM-1800)

Vodafone (GSM-900/1800)

o


Base Transceiver Station and Base Station Controller

Tasks of a BSS are distributed over BSC and BTS

BTS comprises radio specific functions of lower layers (PHY, MAC)

BSC manages and controls the radio channels in the BTS and terrestrial channels to BTS and MSC

Design Principle: “central intelligence” = BSC, “dumb radio station” = BTS

Functions BTS BSCManagement of radio channels XFrequency hopping (FH) X XManagement of terrestrial channels XMapping of terrestrial onto radio channels XChannel coding and decoding XRate adaptation XEncryption and decryption X XPaging X XUplink signal measurements XTraffic measurement XAuthentication XLocation registry, location update XHandover management X


GSM: Air Interface

FDMA (Frequency Division Multiple Access) / FDD (Frequency Division Duplex)

1 2 3 123124. . .

890 MHz 915 MHz

1 2 3 123124. . .

935 MHz 960 MHz

200 kHz

Uplink Downlink

frequency

TDMA (Time Division Multiple Access)

time

Downlink

87654321

4,615 ms = 1250 bit

Uplink

87654321


Framing Modulation(GMSK)

GSM: Voice Coding

Voice coding Channelcoding

Framing Modulation(GMSK)

114 bit/slot114 + 42 bit

Guard (8.25 bits): avoid overlap with other time slots (different time offset of neighboring slot)Training sequence: select the best radio path in the receiver and train equalizerTail: needed to enhance receiver performanceFlag S: indication for user data or control data

1 2 3 4 5 6 7 8

GSM TDMA frame

GSM time-slot (normal burst)

4.615 ms

546.5 µs577 µs

tail user data TrainingSguardspace S user data tail

guardspace

3 bits 57 bits 26 bits 57 bits1 1 3


GSM hierarchy of frames

0 1 2 2045 2046 2047...hyperframe

0 1 2 48 49 50...superframe

0 1 6 7...frame

burstslot

577 µs

4.615 ms

120 ms

6.12 s

3 h 28 min 53.76 s

traffic multiframe

0 1 24 25...

0 1 2 48 49 50... 235.4 mscontrol multiframe

0 1 24 25...

traffic multiframe: 24 frames (22.8 kbps) used for traffic channel (user data), or fast signaling

1 frame (950 bps) used for slow signaling, 1 frame unused

o


Mobile station

Terminal for the use of GSM servicesA mobile station (MS) comprises several functional groups MT (Mobile Termination):

offers common functions used by all services the MS offers corresponds to the network termination (NT) of an ISDN access end-point of the radio interface (Um)

TA (Terminal Adapter): terminal adaptation, hides radio specific characteristics

TE (Terminal Equipment): peripheral device of the MS, offers services to a user does not contain GSM specific functions

SIM (Subscriber Identity Module): personalization of the mobile terminal, stores user parameters, and

security algorithm

R S UmTE TA MT


Network and switching subsystem (NSS)

NSS is the main component of the public mobile network GSM switching, mobility management, interconnection to other networks,

system control

Components

Mobile Services Switching Center (MSC)controls all connections via a separated network to/from a mobile terminal within the domain of the MSC - several BSC can belong to a MSC

Databases (important: scalability, high capacity, low delay)Home Location Register (HLR)

central master database containing user data, permanent and semi-permanent data of all subscribers assigned to the HLR (one provider can have several HLRs)

Visitor Location Register (VLR)local database for a subset of user data, including data about all user currently in the domain of the VLR


Mobile Services Switching Center (MSC)

The MSC plays a central role in GSM switching functions (of traffic channels) additional control functions for mobility support management of network resources interworking functions via Gateway MSC (GMSC) integration of several databases

Functions of a MSC

specific functions for paging and call forwarding termination of SS7 (signaling system no. 7), subscriber signalling to

BSS mobility-specific signaling location registration and forwarding of location information provision of new services (fax, data calls) support of short message service (SMS) generation and forwarding of accounting and billing information


Operation subsystem

The OSS (Operation Subsystem) enables centralized operation, management, and maintenance of all GSM subsystems

Components

Authentication Center (AUC) generates user-specific authentication parameters on request of a VLR

authentication parameters used for authentication of mobile terminals and encryption of user data on the air interface within the GSM system

Equipment Identity Register (EIR) registers GSM mobile stations and user rights

stolen or malfunctioning mobile stations can be locked and sometimes even localized

Operation and Maintenance Center (OMC) different control capabilities for the radio subsystem and the network

subsystem

Basic Functions in GSM Systems

Connection Setup Handover Location management Roaming Authentication


GSM protocol layers for signaling

CM

MM

RR

MM

LAPDm

radio

LAPDm

radio

LAPD

PCM

RR’ BTSM

CM

LAPD

PCM

RR’BTSM

4x16/64 kbit/s

Um Abis A

SS7

PCM32

SS7

PCM3

32x64 kbit/s /2.048 Mbit/s

MS BTS BSC MSC

BSSAP BSSAP

CM: call management (only MS and MSC, transparent through BSC)MM: mobility management (only MS and MSC, transparent through BSC))RR: radio resource management (MS, BSC), terrestrial ch mgm (BSC and MSC)LAPDm: link access procedure for D-channel (HDLC variant – reliable transport)

o


Connection Setup & Radio Resource Assignment

BSBSC MSC


GSM Radio Channels and Signaling Procedures (1)

Radio signaling over „Common Control Channels“ (CCCH: BCCH, PCG, RACH, AGCH) = broadcast, multicast, anycast

1. Broadcast Channels (BCCH, DL):The BCCH is used by the BTS to broadcast system information (PLMN id, LAI, cell id, neighbour cells ids & frequencies, cell states) to all MS in the cell

2. Paging Channel (PCH, DL): In idle mode, the MS is listening to „pagings“ (incoming calls) on the PCH power saving mode

3. Random Access Channel (RACH, UL):RACH is used by the MS for immediate radio access without having a dedicated channel assigned (multiple access by all MS in the cell).

4. Access Grant Channel (AGCH, DL):On detection of a (valid) random access by the BTS, the BSC assigns a dedicated channel (SDCCH) and send the information „immediate assignment“back on the FACH.


GSM Radio Channels and Signaling Procedures (2)

Radio signaling over Dedicated Control Channels (DCH: SDCCH, FACCH) = unicast

5. (Slow) Dedicated Control Channels (SDCCH UL/DL):On receipt of this „immediate assignment“ with correct reference, the MS switches to the assigned SDCCH and starts to establish a L2 connection (LAPDm) to BTS.After L2 connection setup, the first L3 message is sent to BSC or MSC (via BTS) with one of the reasons: „Service Request (MOC)“, „Paging Response (MTC)“, „Location update“. All signaling is now transmitted via this (low capacity) dedicated channel.

6. Traffic channels (TCH UL/DL): for end-to-end speech or data transmission (user plane), a TCH is assigned, and MS and BTS switch simultaneously to it.

7. Fast Associated Control Channels (FACCH UL/DL): are used during user plane conversation for signaling puposes (measurement reports, connection release, handover signaling)


MS-BTS signaling details (MTC/MOC connection setup)

BTSMS

paging request

channel request

immediate assignment

paging response

authentication request

authentication response

ciphering command

ciphering complete

setup

call confirmed

assignment command

assignment complete

alerting

connect

connect acknowledge

data/speech exchange

BTSMS

channel request

immediate assignment

service request

authentication request

authentication response

ciphering command

ciphering complete

setup

call confirmed

assignment command

assignment complete

alerting

connect

connect acknowledge

data/speech exchange

MTC MOC

<-PCHRACH-><-AGCH

<-SDCCH->......

<-TCH/ FACCH->......

connectionless

connection-oriented

(L2 over TCH)

connection-oriented (L2 over SDCCH)

connectionless

connectionless

o


Mobile Terminated Call (MTC)

PSTNcallingstation GMSC

HLR VLR

BSSBSSBSS

MSC

MS

1 2

3

4

5

6

7

8 9

10

11 12

1316

10 10

11 11 11

14 15

17

1: calling a GSM subscriber2: forwarding call to GMSC3: signal call setup to HLR4, 5: request MSRN from VLR6: forward responsible

MSC to GMSC7: forward call to

current MSC8, 9: get current status of MS10, 11: paging of MS12, 13: MS answers14, 15: security checks16, 17: set up connection


Mobile Originated Call (MOC)

PSTN GMSC

VLR

BSS

MSC

MS1

2

6 5

3 4

9

10

7 8

1, 2: connection request3, 4: security check5-8: check resources (free circuit)9-10: set up call


Handover

The problem:Change the cell while communicating

Reasons for handover: Quality of radio link

deteriorates Communication in other cell

requires less radio resources Supported radius is

exceeded (e.g. Timing advance in GSM)

Overload in current cell Maintenance

Link

qua

lity

Link to cell 1 Link to cell 2 time

cell 1

cell 2

Handover margin (avoid ping-pong effect)

cell 1 cell 2


X

BSBS

Before

X

BSBS

During

X

BSBS

After

GSM: Handover Principle

„Hard“ handover, „make before break“ MAHO: Mobile assisted handoff/handover:

MS sends regular measurement reports to network (own cell, neighbor cells, every 480 ms) Network (old BSC) decides upon handover (when, target cell) Network (old BSC) sets up new communication path Network (old BSC) command the MS to execute handover


4 types of handover

(Anchor)MSC MSC

BSC BSCBSC

BTS BTS BTSBTS

MS MS MS MS

12 3 4

• intra-cell handover: reason: quality, interference• inter-cell handover/intra BSS: within same BSS, handled by BSC (reason

mobility, receipt level, power budget, load)• inter-cell handover/inter BSS: between BSC at the same MSC• inter-cell handover/inter MSC: between BSC of different MSCs• Anchor MSC: the initial MSC, which started the connection, keeps control

GMSC


Handover decision

receive levelBTSold

receive levelBTSnew

MS MS

HO_MARGIN

BTSold BTSnew

average over time


Handover procedure (change of BSC)

HO access

BTSold BSCnew

measurementresult

BSCold

Link establishment

MSCMSmeasurementreport

HO decisionHO required

BTSnew

HO request

resource allocationch. activation

ch. activation ackHO request ackHO commandHO commandHO command

HO completeHO completeclear commandclear command

clear complete clear complete

„Make-before-break“ strategy

make

break


Location Management / Mobility Management

The problem: locate a mobile user from the network side without an actice call/connection

(e.g for an incoming mobile-terminated call)

Two extreme solutions:

Mobile registers with each visited cell(e.g. direct call to the hotel room to reach a person)– signaling traffic to register mobile when cell is changed– network has to maintain location information about each mobile+ low signaling load to page mobile (i.e. in one cell only)

Page mobile using a network- or worldwide broadcast message(e.g. broadcast on TV or radio to contact a person)– heavy signaling load to page the mobile (i.e. in all cells)+ no signaling traffic while mobile is idle


RA

RA

RA RA

RA

RA RA

RA

RA

LocationUpdate

LocationUpdate

LocationUpdate

LocationUpdate

LocationUpdate

Location Management / Mobility Management

The issue: Compromise between minimizing the area where

to search for a mobile minimizing the number of

location updates

Solution 1:Large paging area

Solution 2:Small paging area

PagingSignalling Cost

Paging Area UpdateSignalling Cost

TOTALSignalling Cost

+

=


Roaming

The problem: Use a network not subscribed to

Roaming agreement needed between network operators to exchange information concerning: Authentication Authorisation Accounting

Examples of roaming agreements: International Roaming: Use available network abroad National Roaming (exception):

Use of T-Mobile network by O2 (E2) subscribers in area with no O2 coverage


Security in GSM

Security service System was designed with a moderate level of security to authenticate the

subscriber using a pre-shared key and challenge-response. access control/authentication

user SIM (Subscriber Identity Module): secret PIN (personal identification number)

SIM network: challenge response method no authentication of network!

confidentiality voice and signaling encrypted on the wireless link (after successful authentication)

anonymity temporary identity TMSI

(Temporary Mobile Subscriber Identity) newly assigned at each new location update encrypted transmission

3 algorithms specified in GSM A3 for authentication (“secret”, open interface) A5 for encryption (standardized) A8 for key generation (“secret”, open interface)

“secret”:• A3 and A8

available in the Internet

• network providers can use stronger mechanisms


GSM - authentication

A3

RANDKi

128 bit 128 bit

RAND

SRES* =? SRES

A3

RAND Ki

128 bit 128 bit

SRES 32 bit

SRES

Authentication Request (RAND)

Authentication Response (SRES 32 bit)

mobile network

AuC

MSC

SIM

Ki: individual subscriber authentication key SRES: signed response

SRES* 32 bit

Challenge-Response:• Authentication center provides RAND to Mobile• AuC generates SRES using Ki of subscriber and

RAND via A3• Mobile (SIM) generates SRES using Ki and RAND• Mobile transmits SRES to network (MSC)• network (MSC) compares received SRES with one

generated by AuC


GSM - key generation and encryption

A8

RANDKi

128 bit 128 bit

Kc64 bit

A8

RAND Ki

128 bit 128 bit

SRES

RAND

encrypteddata

mobile network (BTS)

MS with SIM

AuC

BTS

SIM

A5

Kc64 bit

A5MS

data data

cipherkey

Ciphering:• Data sent on air interface ciphered for security• A8 algorithm used to generate cipher key• A5 algorithm used to cipher/decipher data• Ciphering Key is never transmitted on air


GSM Evolution – Overview

Spectralefficiency

Datatraffic

adaptivemodulation

EDGE

diversity

space

time

Macro diversity

Intelligent antennas

Equalizeradaptive

redundancyinterference

Frequencyhopping

Dynamicchannel

allocation

GPRS

bursty

HSCSD

continuous

Interference cancelation (multi-user detection)


2G+: GSM Evolution

Limits of GSM limited capacity at the air interface:

data transmission standardized with only 9.6 kbit/s advanced coding allows 14,4 kbit/s not enough for Internet and multimedia applications => EDGE

inappropriateness for bursty and non-symmetrical data traffic => GPRS

Extensions HSCSD (High-Speed Circuit Switched Data) GPRS (General Packet Radio Service) EDGE (Enhanced Data Rate for GSM Evolution) EGPRS (EDGE und GPRS) GERAN (GSM Interface to UMTS)


HSCSD (High-Speed Circuit Switched Data)

continuous use of multiple time slots for a single user

(on a single carrier frequency)

asynchronous allocation of time slots between DL and UL

gain: net data rate up to 115,2 kbps (allocation of all 8 traffic channels)

mainly software update

additional HW needed if more than 3 slots are used

Uplink

Downlink

71 2 3 84 5 6 1 2

71 2 3 84 5 6 1 2


GPRS (General Packet Radio Service)

Introducing packet switching in the network Using shared radio channels for packet transmission over the air:

multiplexing multiple MS on one time slot flexible (also multiple) allocation of timeslots to MS

(scheduling by PCU Packet Control Unit in BSC or BTS)

using free slots only if data packets are ready to send (e.g., 115 kbit/s using 8 slots temporarily)

standardization 1998, introduction 2001 advantage: first step towards UMTS, flexible data services

carrierTS0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7

Multiplexing Multislot capability


Multiplexing and multislot allocation

GPRS network elements GSN (GPRS Support Nodes): GGSN and SGSN GGSN (Gateway GSN)

interworking unit between GPRS and PDN (Packet Data Network) SGSN (Serving GSN)

supports the MS (location, billing, security) HLR (GPRS Register – GR)

maintains location and security information


connection-orientedpacket switched core

GPRS architecture and interfaces

MS BSS GGSNSGSN

MSC

Um

EIR

HLR/GR

VLR

PDN /Internet

Gb Gn Gi

SGSN

Gn


GPRS protocol architecture

appl.

IP/X.25

LLC

GTP

MAC

radio

MAC

radioFR

RLC BSSGP

IP/X.25

FR

Um Gb Gn

L1/L2 L1/L2

MS BSS SGSN GGSN

UDP

Gi

SNDCP

RLC BSSGP IP IP

LLC UDPSNDCP GTP

BSSGP: Base Station Subsystem GPRS Protocol (control plane: routing & QoS)

SNDCP: Subnetwork-Dependent Convergence Protocol (mapping, segmentation, header compression)


GPRS services

Quality-of-Service Parameters reliability delay (delay class 1: 95%-delay < 1.5-7 sec. depending on packet size) throughput service priority

Reliabilityclass

Lost SDUprobability

DuplicateSDU

probability

Out ofsequence

SDUprobability

Corrupt SDUprobability

1 10-9 10-9 10-9 10-9

2 10-4 10-5 10-5 10-6

3 10-2 10-5 10-5 10-2

Delay SDU size 128 byte SDU size 1024 byteclass mean 95 percentile mean 95 percentile

1 < 0.5 s < 1.5 s < 2 s < 7 s2 < 5 s < 25 s < 15 s < 75 s3 < 50 s < 250 s < 75 s < 375 s4 unspecified

o


GPRS services

End-to-end packet switched traffic (peak channel rates) 28 kbps (full use of 3 time slots, CS-1: FEC) 171.2 kbps (full use of 8 time slots, CS-4: no FEC)

Average aggregate throughput of a cell (Source: H. Menkes, WirelessWeb, Aug. 2002)

95 kbps (for both up and downlink)Assumptions: 4/12 reuse, realistic RF conditions, random traffic Worse figures for individual TCP traffic

Adaptive Coding Schemes (adaptive Forward Error Control – FEC) CS 1: 9.05 Kbps/slot CS 2: 13.4 Kbps/slot CS 3: 15.6 Kbps/slot CS 4: 21.4 Kbps/slot (no Forward Error Correction)

Problems and limits IP-based network => high latency, no guarantees Limited data rate: 27 kbps (3 slot/CS-1) - 64.2 kbps (3 slot/CS-4) Latency/flow control problems with TCP


EDGE (Enhanced Data Rates for GSM Evolution)

Enhanced spectral efficiency depends on: Size of frequency band Duration of usage Level of interference with others (power)

EDGE Technology: EDGE can carry data speeds up to 236.8 kbit/s for 4

timeslots (theoretical maximum is 473.6 kbit/s for 8 timeslots)

Adaptation of modulation depending on quality of radio path GMSK (GSM standard – 1 bit per symbol) 8-PSK (3 bits per symbol)

Adaptation of coding scheme depending on quality of radio path (9 coding schemes)

Gain: data rate (gross) up to 69,2kbps (compare to 22.8kbps for GSM)

complex extension of GSM!

NodeB

UE 1

UE 2

Near-far problem


EDGE – Adaptive Modulation and Coding SchemesS c h e m e M o d u la t i o n M a x i m u m

ra te [k b /s ]C o d e R a te F a m i l y

M C S -9 5 9 .2 1 .0 AM C S -8 5 4 .4 0 .9 2 AM C S -7 4 4 .8 0 .7 6 BM C S -6 2 9 .6 / 2 7 .2 0 .4 9 AM C S -5

8 P S K

2 2 .4 0 .3 7 BM C S -4 1 7 .6 1 .0 CM C S -3 1 4 .8 / 1 3 .6 0 .8 0 AM C S -2 1 1 .2 0 .6 6 BM C S -1

G M S K

8 .8 0 .5 3 C


Incremental redundancy (IR) principle

Send redundancy only if necessary Generalized Type-II ARQ (Hybrid ARQ - HARQ)

Finer granularity of code rate

DataBlock Error

Detection

ARQ

ErrorDetection

Accept datablock

Block in error

No error

Initial datatransmission

Block in error

Transmitparity ordata sub-block

No error

Deliver to upper layer

o


2G to 3G Evolution: GSM - GPRS - UMTS

GSMRAN

Base station

Base stationcontroller

Base station

Base station

MSC

ISDN

GSM Core (Circuit switched)

HLRAuCEIR

GMSC

TransmissionATM based

GSM


2G to 3G Evolution: GSM - GPRS - UMTS

GPRS Core (PacketSwitched)

SGSN

GGSN

Inter-net

GSMRAN

Base station


Base station

Base station

MSC

ISDN


HLRAuCEIR

GMSC


GSM+GPRS


2G to 3G Evolution: GSM - GPRS – UMTS R99


SGSN

GGSN

Inter-net

GSMRAN

Base station


Base station

Base station

UTRAN

Radio networkcontroller

Base station Base station

Base station

MSC

ISDN


HLRAuCEIR

GMSC


GSM+GPRS+UMTS R99


2G to 3G Evolution: GSM - GPRS - UMTS R5 - IMS


SGSN

GGSN

Inter-net

GSMRAN

Base station


Base station

Base station

UTRAN

Radio networkcontroller

Base station Base station

Base station

TransmissionIP based

3G Core

GERANGERAN + UMTS R5 + IMS


IP Multimedia System (IMS)- Architecture (simplified)

PSTN

PDN

MediaGateway

MGWControl

SessionControl

Services

CommonMultimedia

Service Network (IMS)

AccessProxy

BTS BSC/RNC MSC/SGSN/GGSNUEUE

GSM/GPRS RAN(GERAN)

CommonIP

CoreNetwork

NodeB RNC SGSN/GGSN IP Router

UEUE

UMTS/HSPA RAN

UEUE

802.11 WiF802.16 WiMax

AG

Service and Core Architecture is “Access Agnostic”

AGFW GGSN

PDNRANSGSN

Access GatewayFirewallGateway GPRS Serving NodePacket Data NetworkRadio Access NetworkServing GPRS Serving NodeFWUESIP phone

Cable, ethernet, DSL, etc

o

2G Mobile Communication Systems - tu-ilmenau.de · 2G Mobile Communication Systems 2G Review: GSM...

Documents

Transcript of 2G Mobile Communication Systems - tu-ilmenau.de · 2G Mobile Communication Systems 2G Review: GSM...