80384515-gsm-1

7/29/2019 80384515-gsm-1

1/53

2000 SASKEN All Rights Reserved

Global System forMobile Communication

GSM

7/29/2019 80384515-gsm-1

2/53


GSM-900 (Channels 125 operating band 900Mhz carrier

spacing 200khz spacing 45Mhz)

GSM -1800 (Channels 374 spacing 95Mhz)

What are the types in GSM Network?

7/29/2019 80384515-gsm-1

3/53


GSM in comparison with other Standards

GSM gives mobility without any loss in Audio quality

Encryption techniques used gives high security in the air

Interface and also use of SIM.

Variable Power (Power budgeting- extend battery life)

Minimum Interference.

SMS (Short Message Services)

Emergency Calls

CELL Broadcast

7/29/2019 80384515-gsm-1

4/53


Cellular

Networking technology

that breaks geographicarea into cells shaped like

honey comb

Cell

Area of coverage

provided by one or more

Radio terminals

1

23

4

5

6

7

6

7

2

1

5

GSM Concepts - Cellular Structure

7/29/2019 80384515-gsm-1

5/53


Frequency band

Uplink 890 MHz-915 MHzDownlink 935 MHz-960MHz

Duplex distance 45MHz

Carrier separation 200KHz

Modulation GMSKAir transmission rate 270Kbps

Access method FDMA/TDMA

Speech Coder RPE-LTP-LPC

(Regular pulse excitation

-Long Term predictive

-linear predictive Coder)

GSM System specifications

7/29/2019 80384515-gsm-1

6/53


Uplink TransmissionTransmission from Mobile to Radio Terminal

Down Link Transmission

Transmission from Radio Terminal to MobileUplink and Downlink channels separated by 45 MHz

Transmission Direction

7/29/2019 80384515-gsm-1

7/532000 SASKEN All Rights Reserved

Uplink 890 MHz to 915 MHzDown Link 935 MHz to 960 MHz

25 MHz divided into 125 channels of 200 KHz bandwidth

890.0 890.2 890.4 914.8 915.0

935.0 935.2 935.4 959.8 960.0

UP

DOWN

Access Techniques

7/29/2019 80384515-gsm-1


Time Division Multiple AccessEach carrier frequency subdivided in time domain into 8

time slots

Each mobile transmits data in a frequency, in its particular

time slot - Burst period = 0.577 milli secs.

8 time slots called a TDMA frame. Period is .577 * 8 =

4.616 milli secs

0 1 2 3 4 5 6 7

4.616 ms

0.577 ms

Access Techniques

7/29/2019 80384515-gsm-1


Radio Channel Allocation

7/29/2019 80384515-gsm-1


Transmission on the radio channels

A timeslot has a duration of .577 seconds

8 timeslots(8 x 0.577 = 4.62 ms) form a TDMA frame

If a mobile is assigned one TS it transmits only in this time

slot and stays idle for the other 7 with its transmitter off.

The start on the uplink is delayed from downlink by 3 TS

periods

One TS = duration of 156.25 bits, and its physical contents

is called a burst

0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7

0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7

DownlinkBTS > MS

UplinkMS > BTS

Offset

7/29/2019 80384515-gsm-1


BTS commands MS at different

distances to use different power levels

so that the power arriving at the BTSs Rx is

approximately the same for each TS

- Reduce interference

- Longer battery life

Power Control

7/29/2019 80384515-gsm-1


AuC

MS

MS

BTS

BTS

BTS

BSC

BSC

MSC

MSC

VLR

VLR

GMSC

HLR

PSTN

EIR

Um

Abis

Abis

A

A

OMC Server

Um

GSM - Network Structure

7/29/2019 80384515-gsm-1


GSM Network

SwitchingSystem

MS Mobile Station

BTS Base transceiver System

BSC Base Station Controller

MSC Mobile Switching Center

HLR Home Location Register

VLR Visitor Location Register

EIR Equipment Identity Register

AUC Authentication Center

OMC Operation And Maintenance Center

OMC

AUC

HLR

MSC

EIRVLR

BSC

BTS

MS

External

PSTN &

PDN N/W

SS

BSS Base Station

System

7/29/2019 80384515-gsm-1


Mobile Station (MS)

Hand portable unit

Frequency and Time Synchronization

Voice encoding and transmission

Voice encryption/decryption functions

Power measurements of adjacent cells

Display of short messages

International Mobile Equipment Identifier (IMEI)

7/29/2019 80384515-gsm-1


Subscriber Identity Module (SIM)

Portable Smart Card with memory (ROM-6KB to 16KB-A3/A8algorithm, RAM- 128KB TO 256KB, EEPROM- 3KB to 8KB )

Static Information

International Mobile Subscriber Identity(IMSI) (MCC + MNC+MSIN

Personal Identification Number (PIN)*

Authentication Key (Ki)

Dynamic Information

Temporary Mobile Subscriber Identity(TMSI)

Location Area Identity (LAI)

Phone memories, billing information

Ability to store Short Messages received

7/29/2019 80384515-gsm-1


Base Transceiver Station (BTS)

Consists of one or more radio terminals for

transmission and receptionEach Radio terminal represents an RF Channel

TRX and MS communicates over Um interface

Voice encryption/decryption

Signal processing functions of the radio interface

Uplink Radio channel power measurements

7/29/2019 80384515-gsm-1


Base Station Controller (BSC)

External Interfaces

Abis interface towards the BTS

A interface towards the MSC

Monitors and controls several BTSs

Management of channels on the radio interface

Alarm Handling from the external interfaces

Performs inter-cell Handover

Switching from Abis link to the A link

Interface to OMC for BSS Management

7/29/2019 80384515-gsm-1


Gateway Mobile Services Switching Center(GMSC)

Interface of the cellular network to PSTN

Routes calls between PLMN and PSTN

Queries HLR when calls come from PSTN to mobile

user

Inter-BSC Handover

Performs call switching

Paging

Billing

7/29/2019 80384515-gsm-1


Home Location Register (HLR)

Stores user data of all Subscribers related to the

GMSC International Mobile Subscriber Identity(IMSI)

Users telephone number (MS ISDN)

Subscription information and services

VLR address

Reference to Authentication center for key (Ki)

Referred when call comes from public land network.

7/29/2019 80384515-gsm-1


Visitor Location Register (VLR)

Identity of Mobile Subscriber

Copy of subscriber data from HLR

Generates and allocates a Temporary Mobile

Subscriber Identity(TMSI)

Location Area Code

Provides necessary data when mobile originates

call

7/29/2019 80384515-gsm-1


Authentication Center (AuC)

Stores Subscriber authentication data called Ki, a

copy of which is also stored in in the SIM card

Generates security related parameters to authorize a

subscriber (SRES-Signed RESponse)

Generates unique data pattern called Cipher key

(Kc) for user data encryption

Provides triplets - RAND, SRES & Kc, to the HLR on

request.

7/29/2019 80384515-gsm-1


Security - Authentication

Authentication center provides

RAND to Mobile

AuC generates SRES using Ki

of subscriber and RAND

Mobile generates SRES usingKi and RAND

Mobile transmits SRES to BTS

BTS compares received SRES

with one generated by AuC

MS

Ki RAND

A3

SRES

RAND

SRES

SRES

Auth Result

AuCBTSMS

7/29/2019 80384515-gsm-1


Security - Ciphering

Data sent on air

interface ciphered for

security

A5 and A8 algorithmsused to cipher data

Ciphering Key is

never transmitted on

air

MS

Ki RAND

A8

Kc

MS Network

Um interface

A5 A5

Kc Kc

Data DataCiphered

Data

7/29/2019 80384515-gsm-1


EIR (Equipment Identity Register)

EIR is a database that contains a list of all validmobile station equipment within the network, whereeach mobile station is identified by its InternationalMobile Equipment Identity(IMEI).

EIR has three databases.,

White list - For all known,good IMEIs

Black list - For all bad or stolen handsets

Grey list - For handsets/IMEIs that are uncertain

7/29/2019 80384515-gsm-1


OMC

Fault and Alarm Management

In case of fault, the operator can execute tests and diagnostics

and change the states of the network element. The operator can initiate traffic control.

Configuration and Operations Management

A new software version can be loaded and run at right network

element by the OMC. Installation of new BTSs / BSC.

Performance Management

The operator can schedule the collection of data from a certain

network element.

Security Management

7/29/2019 80384515-gsm-1

26/53


13 Kbps coded to 22.8 kbps

send on Um

From 22.8 decode to 13 kbps

0 1 2 3 4 31

16Kbps

64Kbps

2.048 mbps

13 kbps speech data

3 kbps TRAU

0 1 2 3 4 31

16Kbps

64Kbps

2.048 mbps

BTS

BSC

TRAU

MSC0 1 2 3 4 31

16Kbps

64Kbps

2.048 mbps

From 16 kbps , 3kbps TRAU removed

13 kbps to 64 kbps

What is happening to my speech ?

7/29/2019 80384515-gsm-1

27/53


Channel concept

Physical channel:

One timeslot of a TDMA-frame on one carrier is referred toas a physical channel.

There are 8 physical channels per carrier in GSM, channel

0 to 7(timeslot 0-7)

Logical channel:

A great variety of information must be transmitted

between BTS and the MS,for e.g.user data and control

signaling.Depending on the kind of information

transmitted we refer to different logical channels.Theselogical channels are mapped on physical channel.

7/29/2019 80384515-gsm-1

28/53


Logical channels

Control channels Traffic channels

BCH CCCHDCCH

Half

rate

Full

rate

FCCH SCH BCCH PCH AGCH RACH SDCCH SACCH FACCH

Logical channels

7/29/2019 80384515-gsm-1

29/53


Control channels: Broadcast channels BCH

BCH -

Allotted one ARFCN & is ON all the time in every cell. Present inTS0 and other 7 TS used by TCH.

FCCH - Frequency correction channel

To make sure this is the BCCH carrier.

Allow the MS to synchronize to the frequency.

Carries a 142 bit zero sequence and repeats once in every 10 frameson the BCH.

Synchronization Channel-SCH

This is used by the MS to synchronize to the TDMA frame structure

within the particular cell.

Listening to the SCH the MS receives the TDMA frame number and

also the BSIC ( in the coded part- 39 bits).

Repeats once in every 10 frames.

7/29/2019 80384515-gsm-1

30/53


Control channels Broadcast channels BCH

Broadcast Control Channel-BCCH

The last information the MS must receive in order to receive

calls or make calls is some information concerning the cell.

This is BCCH.

This include the information of Max power allowed in the cell.

List of channels in use in the cell. BCCH carriers for the neighboring cells,Location Area Identity

etc.

BCCH occupies 4 frames (normal bursts) on BCH and repeats

once every Multiframe.

This is transmitted Downlink point to multipoint.

7/29/2019 80384515-gsm-1

31/53


Control Channels: Common Control Channels (CCCH)

CCCH-Shares TS-0 with BCH on a Multiframe.

Paging Channel-PCH

The information on this channel is a paging message including

the MSs identity(IMSI/TMSI).This is transmitted on Downlink,

point-to-multipoint.

Random access channel-RACH When the mobile realizes it is paged it answers by requesting a

signaling channel (SDCCH) on RACH. RACH is also used by the

MS if it wants to originate a call.

Initially MS doesnt know the path delay (timing advance), hence

uses a short burst (with a large guard period = 68.25 bits).

MS sends normal burst only after getting the timing advance

info on the SDCCH.

It is transmitted in Uplink point to point.

7/29/2019 80384515-gsm-1

32/53


Control Channels: Common Control Channels (CCCH)

Access Grant Channel-AGCH

On request for a signaling channel by MS the network assigns a

signaling channel(SDCCH) on AGCH. AGCH is transmitted on the

downlink point to point

7/29/2019 80384515-gsm-1

33/53


Control ChannelsDedicated Control Channels (DCCH)

Stand alone dedicated control channel(SDCCH)

AGCH assigns SDCCH as signaling channel on request by MS.The

MS is informed about which frequency(ARFCN) & timeslot to use

for traffic.

Used for authentication of MS by the network.

The MS communicates with the BSS and MSC over SDCCH until a

TCH is assigned.

This is used both sides, up and Downlink point-point.

7/29/2019 80384515-gsm-1

34/53


Control ChannelsDedicated Control Channels (DCCH)

Slow associated control channel-SACCH

Average signal strengths(RXLev) and quality of service (RXQual)

of the serving base station and of the neighboring cells is sent on

SACCH (on uplink).

Mobile receives information like what TX power it has to transmit

and the timing advance. It is associated with TCH or SDCCH

Fast associated control channel-FACCH

This channel is used by BTS to command a handover. Whenever a

call is to be transferred from one cell to another cell this channelis used in stealing mode.

7/29/2019 80384515-gsm-1

35/53


Traffic Channels-TCH

TCH carries the voice data.

Two blocks of 57 bits contain voice data in the normalburst.

One TCH is allocated for every active call.

Full rate traffic channel occupies one physical channel(one

TS on a carrier) and carries voice data at 13kbps

Two half rate (6.5kbps) TCHs can share one physical

channel.

7/29/2019 80384515-gsm-1

36/53


Burst

The information format transmitted during onetimeslot in the TDMA frame is called a burst.

Different types of bursts:

Normal Burst

Random Access Burst

Frequency Correction Burst

Synchronization Burst

7/29/2019 80384515-gsm-1

37/53


T

3

Coded Data

57

S

1

T. Seq.

26

S

1

Coded Data

57

T

3

GP

8.25

Tail Bit(T) :Used as Guard TimeCoded Data :It is the Data part associated with the burst

Stealing Flag :This indicates whether the burst is carrying

Signaling data (FACCH) or user info (TCH).

Training Seq. :This is a fixed bit sequence known both to

the BTS & the MS.This takes care of the

signal deterioration.

156.25 bits 0.577 ms

Normal Burst

7/29/2019 80384515-gsm-1

38/53


T

3

Training Sequence

41

Coded Data

36

T

3

GP

68.25

Random Access Burst

T

3

Fixed Bit Sequence

142

T

3

GP

8.25

T3

Coded Data39

Training Sequence64

CodedData 39

T3

GP8.25

Freq. Correc. Burst

Synchronization Burst

156.25 bits 0.577 ms

156.25 bits 0.577 ms

156.25 bits 0.577 ms

H d

7/29/2019 80384515-gsm-1

39/53


Handover

Means to continue a call even a mobile crosses theborder of one cell to another

Procedure which made the mobile station really roam

Handover causes

RxLev (Signal strength , uplink or downlink)

RxQual

O & M intervention

Timing Advance

Traffic or Load balancing

H d T

7/29/2019 80384515-gsm-1

40/53


Handover Types

Internal Handover (Intra-BSS)

Within same base station - intra cell

Between different base stations - inter cell

External Handover (Inter-BSS)

Within same MSC -intra MS Between different MSCs - inter-MSC

7/29/2019 80384515-gsm-1

41/53


Handover Types

BSC

BSC

BSC

BSC

MSC

MSC

GMSC

C-1 C-2

C-3

C-4

7/29/2019 80384515-gsm-1

42/53


Periodic Measurement

Reports (SACCH)


Reports

HO required

Activate TCH(facch)

with HoRef#

if1. Check for HO passed2. Channel avail in new BTS

Acknowledges and

alloctes TCH (facch)

HO cmd with HoRef#Receives new BTS data(FACCH)

MS tunes into new frequency

and TS and sends HO message to

new BTS (facch)


Reports (SACCH)

HO performed

Release TCH

Cell 1

Cell 2

BSC

BTS 1

BTS 2

Intra BSC handover

GSM Id tifi S b ib Id titi MSISDN

7/29/2019 80384515-gsm-1

43/53


GSM Identifiers-Subscriber Identities - MSISDN

The MSISDN is a GSM directory number which

uniquely identifies a mobile subscription in thePublic Switched Telephone Network (PSTN).

Calls will be routed from the PSTN and other

networks based on the Mobile Subscribers MSISDN

number.

MSISDN = CC + NDC + SN

CC= Country Code (91)

NDC= National Destination Code(98370)

SN= Subscriber Number (12345)

I t ti l M bil S b ib Id tit [IMSI]

7/29/2019 80384515-gsm-1

44/53


International Mobile Subscriber Identity [IMSI]

A subscriber is always identified within the GSMnetwork by the IMSI This is used for all signaling in

the PLMN. It is stored in the Subscriber IdentityModule(SIM), in the HLR and in the VLR. The IMSIconsists of three different parts.

IMSI= MCC + MNC + MSIN

(Maximum of 15 digits)=(3 digits)+(1-2digits)+(maximum 11 digits)

MCC = Mobile Country Code

MNC = Mobile Network Code

MSIN = Mobile Station Identification Number

T M bil S b ib Id tit [TMSI]

7/29/2019 80384515-gsm-1

45/53


Temporary Mobile Subscriber Identity [TMSI]

The TMSI is used for the subscribersconfidentiality.

It should be combined with the LAI to uniquely

identify a MS.

Since the TMSI has only local significance (that is,within the MSC/VLR area), the structure may be

chosen by each administration.

The TMSI should not consist of more than four octets.

Mobile Station Roaming Number[MSRN]

7/29/2019 80384515-gsm-1

46/53


Mobile Station Roaming Number[MSRN]

HLR knows in what Service area the subscriber is located.In order to provide a temporary number to be used for

routing, the HLR requests the current MSC/VLR to allocate a

Mobile Station Roaming Number(MSRN) to the called

subscriber and to return it. At reception of the MSRN, HLR

sends it to the MSC, which now can route the call to theVLR where the called subscriber is currently registered.

International Mobile Equmt Identity [IMEI]

7/29/2019 80384515-gsm-1

47/53


International Mobile Equmt. Identity [IMEI]

The IMEI is used for equipment identification. AnIMEI uniquely identifies a mobile station as a piece

or assembly of equipment.

IMEI = TAC + FAC + SNR + sp

TAC= Type Approval Code (6 digits),determined by GSM

body

FAC= Final Assembly Code (2 digits), identifies the

manufacturer

SNR= Serial Number (6 digits), uniquely identifying all

equipment within each TAC and FAC

sp = Spare for future use (1 digit)

Location Area Identity

7/29/2019 80384515-gsm-1

48/53


Location Area Identity

LAI identifies a location area which is a group of cells.

It is transmitted in the BCCH.

When the MS moves into another LA (detected by monitoringLAI transmitted on the BCCH) it must perform a LU.

LAI = MCC + MNC + LAC MCC= Mobile Country Code(3 digits), identifies the country

MNC= Mobile Network Code(1-2 digits), identifies the GSMPLMN

LAC= Location Area Code, identifies a location area within a

GSM PLMN network. The maximum length of LAC is 16 bits,enabling 65536 different location areas to be defined in oneGSM PLMN.

7/29/2019 80384515-gsm-1

49/53


7/29/2019 80384515-gsm-1

50/53


MS registration in network

MS scans complete GSM frequency band for highestpower

Tunes to highest powered frequency and looks for

FCCH. Synchronizes in frequency domain

Get training sequence from SCH which follows

FCCH. Synchronizes in time domain.

Accesses BCCH for network id, location area andfrequencies of the neighboring cells

7/29/2019 80384515-gsm-1

51/53


MS BTS BSC (G)MSC VLR HLR Action

Channel Request (RACH)

Channel Assignment (AGCH)

Authentication Request (SDCCH)

Authentication Response (SDCCH)

Comparison of Authentication params

Accept LUP and allocTMSI (SDCCH)

Ack of LUP and TMSI (SDCCH)

Entry of new area and identity into

VLR and HLR

Channel Release (SDCCH)

MS Location Update (registration)

Location Update Request (SDCCH)TMSI + old LAI

7/29/2019 80384515-gsm-1

52/53


MS

MS

BTS

BTS

BTS

BSC

BSC

MSC

VLR

GMSC

HLR

PSTN

EIR

AuC

Req for dedicated channel

for signaling (RACH)

Give SDCCH

Allocates SDCCH using the AGCH

Sends call set-up request including

dialled digits on SDCCHCall set-up forwarded

to BSC

Call set-up forwarded

to MSC

Authentication request

(SDCCH)

Authentication response

(SDCCH)

Authentication response

(SDCCH)

Assigns TCH Req

Activate TCH

TCH assigned

Assn complete

Release SDCCH

SDCCH releasedRing tone over FACCH

Ring alert

Called Sub answers

Connect

message

Ring tone ceases over FACCHSpeech path enabled

Mobile Originated Call

7/29/2019 80384515-gsm-1

53/53

Mobile Terminated CallMS

MS

BTS

BTS

BTS

BSC

BSC

MSC

VLR

GMSC

HLR

PSTN

EIR

AuC

Land to

Mobile call

(MSISDN)

Query for

VLR info

Reply

(MSRN)

Route

to MSC

Query VLR

for LAC and

TMSIPaging

the area

(+TMSI)

TMSI Paged

on PCH

Paging

Ch. REQ

overRACH

Allocate SDCCH

overAGCH

Page RESP on SDCCH

( TMSI + LAI)Page RESPage RES

Assign. REQ

Assignment CMD

(=TCH) on SDCCH

* MS tunes

* Phone rings Connect traffic Ch.to trunk

frees SDCCH

Network Alerting

Documents

80384515-gsm-1