gsmV1.1

ver1.1 WIPRO Global R&D 1

Global System for Mobiles

GSM


Contents

• Introduction• GSM Concepts• GSM System Specifications• GSM Network• GSM Entities and Signaling Architecture• Functional plane - Radio Resource management• GSM Identifiers• Functional plane - Mobility Management• Functional Plane - Connection Management• References


• Analog standards– Advanced Mobile Phone Service (AMPS)

• US, 800 MHz band

– Total Access Communication System (TACS)• UK, based on AMPS in 900 MHz band

– Nordic Mobile Telephone System(NMT)• Scandinavian, Both in 450 MHz and 900 MHz band

Evolution of Cellular communication standards


• Digital Standards– Dual mode AMPS (D-AMPS)

• US, Analog signaling and Digital voice coding

– IS-95• US, CDMA based

– Global Systems for mobile communications (GSM)

• European standard, 890 MHz - 960 MHz band

Evolution of Cellular communication standards ...


• There were so many systems available need to consolidate ,Limitations of Analogue system,Incompatibility between systems.Moving towards PCN(Personal Communications Network)

• Mobility was the keyword in developing a new system to reach people on move between countries yet stay connected.

Why GSM?


• GSM-900 (Channels 125 operating band 900Mhz carrier spacing 200khz spacing 45Mhz)

• GSM -1800 (Channels 374 spacing 95Mhz)

What are the types in GSM Network?


• GSM gives mobility without any loss in Audio quality • Encryption techniques used gives high security in the air

Interface and also use of SIM.• Bit Interleaving for high efficiency in Transmission.• Variable Power (Power budgeting- extend battery life)• Minimum Interference.(Eq DTX )• Features-CCS7 Signaling

– SMS (Short Message Services)

– Emergency Calls

– CELL Broadcast

GSM in comparison with other Standards?


• Cellular– Networking

technology that breaks geographic area into cells shaped like honey comb

• Cell– Area of coverage

provided by one or more Radio terminals

1

2

3

4

56

76

7

2

1

5

GSM Concepts - Cellular Structure


Cell Planning• Traffic and Coverage Analysis•Collection of data•Traffic calculation•Nominal Cell Plan•Coverage and Interference Prediction•Site Survey and Signal strength Measurement•Evaluation, final Cell Plan•Installation•Optimization


• Uplink Transmission– Transmission from Mobile to Radio Terminal

• Down Link Transmission– Transmission from Radio Terminal to Mobile– Uplink and Downlink channels separated by 45

MHz

Transmission Direction


FDM

TDM

Power

f1 f2

0

8

0

8


• Uplink 890 MHz to 915 MHz

• Down Link 935 MHz to 960 MHz

• 25 MHz divided into 125 channels of 200 KHz bandwidth

890.0 890.2 890.4 914.8 915.0

935.0 935.2 935.4 959.8 960.0

UP

DOWN

Access Techniques


• Time Division Multiple Access– Each carrier frequency subdivided in time

domain into 8 time slots – Each mobile transmits data in a frequency, in

its particular time slot - Burst period = 0.577 milli secs.

– 8 time slots called a TDMA frame. Period is .577 * 8 = 4.616 milli secs

0 1 2 3 4 5 6 7

4.616 ms

0.577 ms

Access Techniques


Frequency band Uplink 890 MHz-915 MHz Downlink 935 MHz-960MHzDuplex distance 45MHzCarrier separation 200KHzModulation GMSKAir transmission rate 270KbpsAccess method FDMA/TDMASpeech Coder RPE-LTP-LPC (Regular pulse excitation -Long Term predictive -linear predictive Coder)

GSM System specifications


MS

MS

BTS

BTS

BTS

BSC

BSC

MSC

MSC

VLR

VLR

GMSC

HLR

PSTN

EIR

AuC

Um

Abis

Abis

A

A

OMC Server

Um

GSM - Network Structure


GSM Network

OMC

AUC

HLR

MSC

EIRVLR

BSC

BTS

MS

ExternalPSTN &PDN N/W

SS

BSS

SwitchingSystem

Base StationSystem

MS Mobile Station

BTS Base transceiver System

BSC Base Station Controller

MSC Mobile Switching Center

HLR Home Location Register

VLR Visitor Location Register

EIR Equipment Identity Register

AUC Authentication Center

OMC Operation And Maintenance Center


Mobile Station (MS)

•Hand portable unit•Frequency and Time Synchronization•Voice encoding and transmission•Voice encryption/decryption functions•Power measurements of adjacent cells•Display of short messages•International Mobile Equipment Identifier (IMEI)


Subscriber Identity Module (SIM)•Portable Smart Card with memory (ROM-6KB to 16KB-A3/A8

algorithm, RAM- 128KB TO 256KB, EEPROM- 3KB to 8KB )

•Static Information

–International Mobile Subscriber Identity(IMSI) (MCC + MNC+MSIN

–Personal Identification Number (PIN)

–Authentication Key (Ki)

•Dynamic Information

–Temporary Mobile Subscriber Identity(TMSI)

–Location Area Identity (LAI)

–Phone memories, billing information

–Ability to store Short Messages received


Base Transceiver Station (BTS)

•Consists of one or more radio terminals for transmission and reception•Each Radio terminal represents an RF Channel•TRX and MS communicates over Um interface•Received data transcoding•Voice encryption/decryption•Signal processing functions of the radio interface•Uplink Radio channel power measurements


Base Station Controller (BSC)•External Interfaces

–‘Abis’ interface towards the BTS–‘A’ interface towards the MSC

•Monitors and controls several BTSs•Management of channels on the radio interface•Alarm Handling from the external interfaces•Performs inter-cell Handover•Switching from ‘Abis’ link to the ‘A’ link•Interface to OMC for BSS Management


Gateway Mobile Services Switching Center (GMSC)

•Interface of the cellular network to PSTN•Routes calls between PLMN and PSTN•Queries HLR when calls come from PSTN to mobile user•Inter-BSC Handover•Performs call switching•Paging•Billing


Home Location Register (HLR)

•Stores user data of all Subscribers related to the GMSC–International Mobile Subscriber Identity(IMSI)–Users telephone number (MS ISDN)–Subscription information and services–VLR address–Reference to Authentication center for key (Ki)

•Referred when call comes from public land network


Visitor Location Register (VLR)

•Identity of Mobile Subscriber•Copy of subscriber data from HLR•Generates and allocates a Temporary Mobile Subscriber Identity(TMSI)•Location Area Code•Provides necessary data when mobile originates call


Authentication Center (AuC)

•Stores Subscriber authentication data called Ki, a copy of which is also stored in in the SIM card•Generates security related parameters to authorize a subscriber (SRES-Signed RESponse)•Generates unique data pattern called Cipher key (Kc) for user data encryption•Provides triplets - RAND, SRES & Kc, to the HLR on request.


EIR is a database that contains a list of all valid mobile station equipment within the network, where each mobile station is identified by its International Mobile Equipment Identity(IMEI).

EIR has three databases.,

White list - For all known,good IMEI’s

Black list - For all bad or stolen handsets

Grey list - For handsets/IMEI’s that are uncertain

EIR (Equipment Identity Register)


GSM Entities and Signaling Architecture


Interfaces and Protocols

Um

Abis A

CB

E

D

F

Digital Networks

POTS

TUP

ISUP

MAP

MAPMAP

BSSAPLAPD

LAPDm

G


Radio Resource Management (RR)• Establish and Release stable connections between

MS and MSC• Manage Limited Radio and Terrestrial resources• Handover process is the sole responsibility of the

RR Layer• Functions of RR layer are performed by MS and

BSC and partly by MSC

Functional Plane of GSM …RR


Physical channel:One timeslot of a TDMA-frame on one carrieris referred to as a physical channel.There are 8 physical channels per carrier inGSM,channel 0-7(timeslot 0-7)Logical channel:A great variety of information must be transmitted between BTS and the MS,for e.g.user data and control signaling.Dependingon the kind of information transmitted we refer to different logical channels.These logicalchannels are mapped on physical channel.

Channel concept


Logical channels

Control channels Traffic channels

BCH CCCH DCCHHalf

rateFullrate

FCCH SCH BCCH PCH AGCH RACH SDCCH SACCH FACCH

Logical channels


Frequency correction channel-FCCHThis serves two purposesTo make sure this is the BCCH carrier.To allow the MS to synchronize to the frequency.

Synchronization Channel-SCHThis is used by the MS to synchronize to the TDMA frame structure within the particular cell.Listening to the SCH the MS receives the TDMAframe number and also the BSIC.

Control channels Broadcast channels BCH


Broadcast Control Channel-BCCHThe last information the MS must receive in order to receive calls or make calls is someinformation concerning the cell. This is BCCH.This include the information of Max powerallowed in the cell,BCCH carriers for the neighboring cells,Location Area Identity etc.This is transmitted Downlink point to multipoint.

Control channels Broadcast channels BCH


Paging Channel-PCHThe information on this channel is a paging message including the MS’s identity(IMSI).This is transmitted on Downlink.

Control channels Common Control Channels,CCCH

Random access channel-RACH:When the mobile realizes it is paged it answers by requesting a signaling channel on RACH. RACH is also used by the MS if it wants to originate a call.It is transmitted in Uplink point to point.


Access Grant Channel-AGCHOn request for a signaling channel by MS the network assigns a signaling channel(SDCCH) on AGCH. AGCH is transmitted on the downlink point to point.

Control channels Common Control Channels,CCCH


Stand alone dedicated control channel(SDCCH)

AGCH assigns SDCCH as signaling channel on request by MS.The MS is informed about which frequency & timeslot to use for traffic.

This is transmitted both sides up and Downlinkpoint-point.

Control channels Dedicated Control Channels-DCCH


Slow associated control channel-SACCHAverage signal strengths and quality of service of the serving base station and of the neighboring cells is sent on SACCH.Mobile receives information like what TX power it has to transmit and the timing advance.

Control channels Dedicated Control Channels-DCCH

Fast associated control channel-FACCHThis channel is used for handover. Whenever a call is to be transferred from one cell to another cell this channel is used.


Traffic Channels-TCH

Full rate traffic channel occupies one physicalchannel(one TS on a carrier)

Two half rate TCHs can share one physicalchannel.


TS 0 - FCCH + BCCH + CCCH

TS 1 - SDCCH + SACCH

TS 2-7 - TCH

0 1 2 3 4 5 6 7 0 1 2 3 ……..

TDMA Frames

Logical to Physical Channel Mapping


Burst

The information format transmitted during one timeslot in the TDMA frame is calleda burst.

Normal Burst Random Access Burst Frequency Correction Burst Synchronization Burst

Different Types of Bursts


Normal Burst

T3

Coded Data57

S1

T. Seq.26

S1

Coded Data57

T3

GP8.25

Tail Bit(T) :Used as Guard TimeCoded Data :It is the Data part associated with the burstStealing Flag :This indicates whether the burst is carrying

Signaling data.Training Seq. :This is a fixed bit sequence known both to

the BTS & the MS.This takes care of the signal deterioration.


T8

Training Sequence41

Coded Data36

T3

GP68.25

Random Access Burst

T3

Fixed Bit Sequence142

T3

GP8.25

T3

Coded Data39

Training Sequence64

CodedData 39

T3

GP8.25

Freq. Correc. Burst

Synchronization Burst


Handover• Means to continue a call even a mobile crosses the

border of one cell to another• Procedure which made the mobile station really roam• Handover causes

– RxLev (Signal strength , uplink or downlink)– RxQual (BER on data)– O & M intervention– Timing Advance– Traffic or Load balancing


Handover Types

– Internal Handover (Intra-BSS)

Within same base station - intra cell

Between different base stations - inter cell

– External Handover (Inter-BSS)

Within same MSC -intra MSC

Between different MSCs - inter-MSC


Handover processCELL 1

CELL 2

BSC

Meas Rep Cell 1Meas Rep Cell 2Meas Rep Cell 1Meas Rep Cell 2LUP ReqLUP Req

LUP Acc + Handover to CELL 1LUP Reply

Handover Complete


GSM Identifiers-Subscriber Identities -MSISDN

The MSISDN is a GSM directory number which uniquely identifies a mobile subscription in the Public Switched Telephone Network (PSTN).

Calls will be routed from the PSTN and other networks based on the Mobile Subscribers’ MSISDN number.

MSISDN= CC + NDC + SN

CC= Country Code (91)

NDC= National Destination Code(98370)

SN= Subscriber Number (12345)


International Mobile Subscriber Identity [IMSI]

A subscriber is always identified within the GSM network by the IMSI This is used for all signaling in the PLMN. It is stored in the Subscriber Identity Module(SIM), in the HLR and in the VLR. The IMSI consists of three different parts.

IMSI= MCC + MNC + MSIN

(Maximum of 15 digits)=(3 digits)+(1-2 digits)+(maximum 11 digits)

MCC = Mobile Country Code

MNC = Mobile Network Code

MSIN = Mobile Station Identification Number


Temporary Mobile Subscriber Identity [TMSI]

The TMSI is used for the subscriber’s confidentiality.

It should be combined with the LAI to uniquely identify a MS.

Since the TMSI has only local significance (that is, within the MSC/VLR area), the structure may be chosen by each administration.

The TMSI should not consist of more than four

octets.


Mobile Station Roaming Number[MSRN]

HLR knows in what Service area the subscriber

is located. In order to provide a temporary number

to be used for routing, the HLR requests the current

MSC/VLR to allocate a Mobile Station Roaming

Number(MSRN) to the called subscriber and to

return it. At reception of the MSRN, HLR sends it

to the MSC, which now can route the call to the

VLR where the called subscriber is currently

registered.


International Mobile Equmt. Identity [IMEI]

The IMEI is used for equipment identification. An IMEI

uniquely identifies a mobile station as a piece or assembly of

equipment.

IMEI = TAC + FAC + SNR + sp

TAC= Type Approval Code (6 digits),determined by GSM body

FAC= Final Assembly Code (2 digits), identifies the

manufacturer

SNR= Serial Number (6 digits), uniquely identifying all

equipment within each TAC and FAC

sp = Spare for future use (1 digit)


Location Area IdentityLAI identifies a location area which is a group of cells.. It is transmitted in the BCCH. When the MS moves into another LA (detected by monitoring LAI transmitted on the BCCH) it must perform a LU.

LAI = MCC + MNC + LAC MCC= Mobile Country Code(3 digits), identifies the country

MNC= Mobile Network Code(1-2 digits), identifies the GSM-

PLMN

LAC= Location Area Code, identifies a location area within a GSM

PLMN network. The maximum length of LAC is 16 bits,

enabling 65536 different location areas to be defined in

one GSM PLMN.


Functional Plane - Mobility Management

Mobility Management (MM)• Location updating• Paging• Security Management

– Preventing unauthorized users– Maintaining Privacy of users

• Providing roaming facility• MM functionality mainly handled by MS, HLR,

MSC/VLR.


Location Update

HLR

MSC/VLR(ID=1) BSC BTS

BTSMSC/VLR(ID=2)

IMSI MGT

BSC

IMSI MSC/VLR(ID=1)(ID=2)

IMSI

LAI=1

LAI=2

VLR

(1)Locationupdate request(2)

(3)SubscriberInformationRequest

(4)SubscriberInformation

(5)LocationCancellation

(6)LocationUpdateacknowledge


Security - Authentication

– Authentication center provides RAND to Mobile

– AuC generates SRES using Ki of subscriber and RAND

– Mobile generates SRES using Ki and RAND

– Mobile transmits SRES to BTS

– BTS compares received SRES with one generated by AuC

MSKi RAND

A3

SRES

RAND

SRES

SRES

Auth Result

AuCBTSMS


Security - Ciphering

– Data sent on air interface ciphered for security

– A5 and A8 algorithms used to cipher data

– Ciphering Key is never transmitted on air

MSKi RAND

A8

Kc

MS NetworkUm interface

A5 A5

Kc Kc

Data DataCiphered

Data


Functional Plane Communication Management

(CM)

• Setup of calls between users on request

• Routing function i.e. Choice of transmission segments linking users

• Point to Point Short message services


• MS scans complete GSM frequency band for highest power

• Tunes to highest powered frequency and looks for FCCH. Synchronizes in frequency domain

• Get training sequence from SCH which follows FCCH. Synchronizes in time domain.

• Accesses BCCH for network id, location area and frequencies of the neighboring cells

MS registration in network


MS BTS BSC (G)MSC VLR HLR Action

Channel Request (RACH)

Channel Assignment (AGCH)

Location Update Request (SDCCH)

Authentication Request (SDCCH)

Authentication Response (SDCCH)

Comparison of Authentication params

Accept LUP and allocTMSI (SDCCH)

Ack of LUP and TMSI (SDCCH)

Entry of new area and identity into VLR and HLR

Channel Release (SDCCH)

MS registration in network


Mobile Originated CallMS

MS

BTS

BTS

BTS

BSC

BSC

MSC

VLR

GMSC

HLR

PSTN

EIR

AuC

Req for dedicated channel for communication (RACH)Alloc of dedicated channel(AGCH)Call establishment request(SDCCH)Authentication request(SDCCH)Authentication response(SDCCH)

Authentication response(SDCCH)

Ciphering command(SDCCH)Ciphering response(SDCCH)

Assignment of TCH(AGCH) Call Setup

Assignment of TCH(AGCH)

Call Setup

Alerting(TCH) Alerting

Alerting(TCH)

Connected(TCH) Connected

Connected(TCH)

Connected

Exchange ofCommunication

Exchange of communication(TCH)

Exchange ofCommunication

Call release

Call release(TCH)

Call release


Mobile Terminated CallMS

MS

BTS

BTS

BTS

BSC

BSC

MSC

VLR

GMSC

HLR

PSTN

EIR

AuC

Land to Mobile call

Query forVLR info

Reply

Routeto MSC

Query VLR for LAC andTMSIPaging

the area

Paging

Paging


• Wireless and Personal Communication Systems. Vijay.K.Garg and Wilkes.

• Overview of the GSM System and Protocol Architecture, IEEE Comm. magazine Moe Rahnema.

• The GSM System for Mobile Communications– Michel Mouly & Marie-Bernadette Pautet

Overview of the GSM Comm.– John Scourias.

References

gsmV1.1

Documents

Transcript of gsmV1.1