No Slide Title

GSM Architecture

24 May 20121RTTC, Nagpur1111Mobile station Power adjustable in 2 db steps.down to 13 db(20mw) , under remote control from BTS . BTS measure received power from MS (minimum) . This is to minimize Co-channel Interference. Adjustment with 13 TDMA frame(60 ms).The required power level is determined by BSC.24 May 20127RTTC, Nagpur Network Architecture

BTSMSC VLR

HLR

PSTNISDN

DataNetworks(Air interface

OSSBTSBTSMSC VLR

BSC1 MSC=16 BSC1 BSC=1024 TRUA InterfaceA-bis interfaceBSC:BASE STATION CONTROLLER, BTS: BASE TRANSRECEIVER STATION, OSS: OPERATION AND SUPPORT SUBSYSTEM.ss24 May 20123RTTC, Nagpur3GSMFunctions of Mobile StationVoice and data transmissionFrequency and time synchronizationMonitoring of power and signal quality of the surrounding cells Provision of location updates even during inactive stateEqualization of multi path distortions

24 May 20124RTTC, Nagpur4GSMMobile StationPortable, vehicle mounted, hand heldMS identified by unique IMEI(International Mobile Equipment Identity)Shall display at least last ten received, dialled and missed callsMinimum talk time of 1hr 30 min. and standby time of 80 hrs160 characters long SMS

24 May 20125RTTC, Nagpur5GSMMobile Station - Power Levels

Vehicle mounted24 May 20126RTTC, Nagpur6GSMSIM CardSIM ModuleUnique Subscribers ID IMSI and ISDNPIN( Personal Identification Number)Key Ki( Identification Key) , Kc and A3,A5 and A8 algorithmsSIM has CPU, ROM, RAM and EPROM

24 May 20128RTTC, Nagpur8GSMMobile Identification NumbersIMEIMSISDNIMSITMSIMSRN

24 May 20129RTTC, Nagpur9GSMMSISDNMobile Subscribers ISDN NumberThe MSISDN is registered in the telephone directory and used by the calling party for dialing.MSISDN shall not exceed 15 digits.NDS--National Significant Number---Give Routing Information to reach HLRN(S)N--National Significant Number

CCNDCSN1 to 3 digitsVariableVariableMSISDN : not more than 15 digitsN(S)N24 May 201210RTTC, Nagpur10GSMIMSIInternational mobile subscribers IdentityThe IMSI is an unique identity which is used internationally and used within the network to identify the mobile subscribers. The IMSI is stored on the subscriber identity module (SIM), the HLR, VLR and AC database.

24 May 201211RTTC, Nagpur11GSMIMSI3 digitsMCCMNCMSIN3 digitsNot more than 9 digitsNMSIIMSI : Not more than 15 digitsMCC--Mobile Country Code, MNC--Mobile N/W Code, MSIN--Mobile Station Identification Number NMSI--National Mobile Station Identity,assigned by Individual Administration.Mobile station Identification Number. It identifies the subs. In a PLMN. First 3 digit identifies the Logical HLR-id of Mobile subs.24 May 201212RTTC, Nagpur12GSM, TMSI

Temporary Mobile subscribers IdentityThe TMSI is an identity which guarantees the integrity of the mobile subscribers on the radio interface and protect the Subs. from being identified by those attempting to monitor the Radio CHL. The VLR assigns a TMSI to each mobile subscribers entering the VLR area.Assigned only after successful authentication.TMSI has only local significance i.e. within VLR & area controlled by the VLRTMSI changes on location updationTMSI is less than 8 digit

24 May 201213RTTC, Nagpur13GSMMSRNMobile Station Roaming NumberThe MSRN is used in the GMSC to set up a connection to the visited MSC/VLR. MSRN--is a temporary identity which is assigned during the establishment of a call to a roaming subs.

CC NDS SNCC--Country Code, NDC--National Destination Code, SN-- Subs. No.24 May 201214RTTC, Nagpur14GSMIMEIInternational Mobile Equipment IdentityThe IMEI is an unique code allocated to each mobile equipment. It is checked in the EIR.IMEI checkWhite ListGrey ListBlack List

24 May 201215RTTC, Nagpur15RADIO SUB SYSTEM (RSS)n BTSn BTSBSCBSCBSCMSC/VLRRSS24 May 201216RTTC, Nagpur16GSMFUNCTION OF BTS -I

Encodes, encrypts, multiplexes, modulates and feeds the RF signals to the antenna

Transcoding and rate adaption Functionality

Time and frequency synchronisation signals transmission.

11 power classes from .01 watts to 320 watts 24 May 201217RTTC, Nagpur17GSMFUNCTION OF BTS -II

Frequency hopping

Random access detection

Uplink radio channel measurements

BTS mainly consists of a set of transceivers (TRX). 24 May 201218RTTC, Nagpur18GSMFUNCTIONS OF BSC-I

It is connected to BTS and offloads MSCRadio resource management Inter-cell handover Reallocation of frequenciesPower control24 May 201219RTTC, Nagpur19GSMFUNCTIONS OF BSC-II

Time delay measurement of the received signals from MS with respect to BTS clock.

Performs traffic concentration to reduce the number of lines from BSC to MSC.

24 May 201220RTTC, Nagpur20GSMFUNCTIONS OF BSC-III

BSC performs call processing

TRAU are generally located at the site of MSC.

BSC- BTS configurations as per requirement.

Data from OMC and can be down loaded to BSC 24 May 201221RTTC, Nagpur21Network and Switching Subsystem (NSS)MSC(PSTN)VLRHLRAUCEIRDCSS7 SignallingTraffic PathF(BSS)A

EOtherMSC24 May 201222RTTC, Nagpur22GSMMSC ( MOBILE SWITCHING CENTRE)Manages communication between GSM & other network Call setup functions, basic switching are doneMSC takes into account the RR allocation in addition to normal exchange functionsMSC does gateway function while its customers roams to other network by using HLR /VLR

24 May 201223RTTC, Nagpur23GSMMSC Functions - IPaging, specifically call handling Location updationHandover managementBilling for all subscribers based in its areaReallocation of frequencies to BTSs in its area to meet heavy demands

24 May 201224RTTC, Nagpur24GSMMSC Functions - IIEcho canceller operation control

Signaling interface to databases like HLR, VLR.

Gateway to SMS between SMS centers and subscribers

Handle interworking function while working as GMSC24 May 201225RTTC, Nagpur25INTERWORKING FUNCTION-It provide the Interfacing Capability to Data N/Ws.-IMF. A part of MSC, provides the subscriber with access to data rate and protocol conversion facilities so that data can be transmitted between GSM Data Terminal Equipment ( DTE ) and a land line DTE.

24 May 201226RTTC, NagpurGSM Home Location Register(HLR)-IReference store for subscribers parameters, numbers, authentication & Encryption values.

Current subscriber status and associated VLR.

Both VLR and HLR can be implemented in the same equipment in an MSC.

one PLMN may contain one or several HLR.24 May 201227RTTC, Nagpur27GSM Home Location Register(HLR)-IIPermanent data in HLRData stored is changed only by man-machine.

IMSI, MS-ISDN number.

Category of MS ( whether pay phone or not )

Roaming restriction ( allowed or not ).

Supplementary services like call forwarding 24 May 201228RTTC, Nagpur28GSM Home Location Register(HLR)-IIITemporary data in HLRThe data changes from call to call & is dynamic

MSRN

RAND /SRES and Kc

VLR address , MSC address.

Messages waiting data used for SMS

24 May 201229RTTC, Nagpur29GSMVISITOR LOCATION REGISTER (VLR)-I

It controls those mobiles roaming in its area.

VLR reduces the number of queries to HLR

One VLR may be incharge of one or more LA.

VLR is updated by HLR on entry of MS its area.

VLR assigns TMSI which keeps on changing.

IMSI detach and attach operation

24 May 201230RTTC, Nagpur30GSMData in VLRIMSI & TMSI MSISDN MSRN.Location AreaSupplementary service parametersMS categoryAuthentication Key

24 May 201231RTTC, Nagpur31GSMAUTHENTICATION CENTRE (AUC )-I

AUC is a separate entity and physically included in HLR

Protect against intruders in air interface

Authentication (Ki) and ciphering (Kc) key are stored in this data base.

Keys change randomly with each call

Keys are never transmitted to MS on air Only calculated response are sent.

24 May 201232RTTC, Nagpur32AUTHENTICATION & ENCRIPTIONAUCDatabase

Generation of Random NumberRANDRANDIMSI1IMSI3IMSI2ki1ki2ki3RANDSRESKcAlgorithm forCipheringA8Algorithm for AuthenticationA3 Kc64 bitsSRES32 bitsHLR24 May 201233RTTC, Nagpur33GSMEQUIPMENT IDENTITY REGISTER ( EIR )

This data base stores IMEI for all registered mobile equipments and is unique to every ME.

Only one EIR per PLMN.

White list : IMEI, assigned to valid ME.Black list : IMEI reported stolenGray list : IMEI having problems like faulty software, wrong make of equipment etc.

24 May 201234RTTC, Nagpur34The centralized operation of the various units in the system and functions needed to maintain the subsystems.

Dynamic monitoring and controlling of the network

Operations and Maintenance Centre OMC24 May 201235RTTC, Nagpur35functions -O&M data function

-Configuration management

--Fault report and alarm handling

-Performance supervision/management

-Storage of system software and data

Functions Of OMC24 May 201236RTTC, Nagpur36GSMGeneric Authentication ProcessA3A3KiKiRANDRANDCompareSRESSRESResponseIMSIIMSIYes/NoRadio Path24 May 201237RTTC, Nagpur37Authentication Authentication is used to check the validity of a mobile subscriber.At MSAt N/WKiRAND( 128 bits )KiA3A3SRES SRES( 32 bits )=?AUTHENTICATION24 May 201238RTTC, Nagpur RAND ( 128 bits ):Random Number SRES ( 32 bits) :Signed Response Kc ( 64 bits ) : Ciphering Key - Ki is stored in SIM and HLR. Ki ( 128 bits) : Identification Key- Purpose : Ki is used to calculate SRES and Kc. - Ki is never transmitted over signaling network.- Purpose : Kc is used to encrypt data over radio interface.- Purpose : RAND is used to calculate SRES and Kc.24 May 201239RTTC, Nagpur40IN THIS PRESENTATIONGSM - RADIO INTERFACE Radio Interface Frequency Bands & Specifications Multiple Access Method FDMA & TDMA Modulation Method FDMA /TDMA Frame Representation Logical Channels Traffic & Control Operational Concepts

Other Salient Features of RF I/F- DTX, Time Alignment Diversity, Fr. Hopping, Power Control.24 May 2012RTTC, Nagpur41Communication - Mobile

TelephoneExchangeSubscriberLine (2W)Inter-ExchangeJunctionMobile SwitchingCentre (MSC)

BSCBTSMS

24 May 2012RTTC, Nagpur42GSMRADIO INTERFACEMost Important InterfaceTo increase spectral efficiency-- Large number of simultaneous calls in a given bandwidth-- Frequency Reuse-- Interference-- Use of Interference Reduction TechniquesFull Compatibility between mobile stations of various Manufacturers & Networks of different vendors to help roaming

24 May 2012RTTC, Nagpur43GSMUplink & DownlinkFrequency Bands GSM 900 Mhz DCS 1800 MHz BTS

UPLINKDOWNLINK

24 May 2012RTTC, Nagpur44GSM Specifications GSM 900 Mobile to BS(UP-LINK) -890 to 915 MHzBS to Mobile (DOWN -LINK) - 935 to 960 MHz Bandwidth - 25 MHz GSM 1800 ( DCS ) Mobile to Cell(UP-LINK) -1710 to 1785 MHz Cell to Mobile (DOWN -LINK) - 1805 to 1880 MHz Bandwidth - 75 MHz

RF Spectrum : 24 May 2012RTTC, Nagpur45

GSM Specifications Carrier Separation -200 kHzNo. of RF Carriers -124Access Method -TDMA/FDMAModulation Method -GMSKTransmission Rate -270.833 KbpsSpeech Coding -Full rate 13 Kbps Half rate 6.5 KbpsDuplex Distance -45 MHz24 May 2012RTTC, Nagpur46GSMDigital Voice Transmission

- In GSM speech coding a block of 20 ms is encoded in one set of 260 bits. - This calculates as 50X 260 = 13 kbps. Thus GSM speech coder produces a bit rate of 13 kbps per subscriber. - This provides speech quality which is acceptable for mobile telephony and comparable with wire-line PSTN phones.Speech Coding24 May 2012RTTC, Nagpur47GSMDigital Voice Transmission

- It uses 260 bits from speech coding as input and outputs 456 encoded bits. - In one burst one block of 57 bits from one sample and another block from another sample are sent together. - These 456 bits for every 20 ms of speech are interleaved forming eight blocks of 57 bits each.Channel CodingInterleaving24 May 2012RTTC, Nagpur48GSMDigital Voice Transmission

- Additional bits as training sequence added to basic speech/data. - Total of 136 bits added, bringing overall total to 592 bits. - To counteract the problems encountered in radio path.Burst Formatting - Each TS of TDMA frame is 0.577 ms long and during this time 156.25 bits are transmitted. - One burst contains only 148 bits. Rest of the space, 8.25 bits time, is empty and is called Guard Period ( GP ). - GP enables MS/BTS to ramp up and ramp down.24 May 2012RTTC, Nagpur49 FDMA/TDMA SchemeBP1BP2BP3BP4BP5BP6BP7BP8BP1BP2TIME890.0 890.2890.4890.6890.8891.0891.2915.8FREQMHzBURSTFRAME

24 May 2012RTTC, Nagpur5087654321FRAME OF 8 TIME SLOTSFRAME REPETITIONPHYSICAL CHANNELS8765432187654321876543218765432111111122222333334444466666777778888855555PHYSICAL CHANNELS1245678 3

24 May 2012RTTC, Nagpur51GSM Radio Interface - CYCLES20470Hyperframe = 2048 Superframes3 Hours 28 Minutes 53 Seconds and 760 milliseconds500250Superframe = 26 51 multiframes6.12 Seconds51 MultiframeApprox 235 mS26 Multiframe120 mS25242105049481076543210TDMA frame4.615 mS

24 May 2012RTTC, Nagpur52GSM-- TDMA STRUCTURE TDMA 8 Time Slots / RF Channel Time slot duration 0.577m sec or 15 / 26 m sec Frame 8 Burst Periods ( Time Slots) = 8 15/26 = 4.615 m sec Multi Frame Traffic 26 4.615 = 120 msec Control 51 4.615 = 235.365 m sec Super Frame 51 Traffic Multi frames 26 Control Multi frames Hyper Frame 2048 Super Frames = 3 28 52.76 hr min sec

24 May 2012RTTC, Nagpur53GSMLOGICAL CHANNELS USER INFORMATION( TRAFFIC) SIGNALLING INFORMATION (CONTROL)

24 May 2012RTTC, Nagpur54GSM CONTOL CHHANELS OVER LOGICAL CHANNELS THREE TYPES OF CONTROL CHANNELS Intended to carry signalling and synchronisation Broadcast control channel BCCH Common control channel CCCH Dedicated control channel DCCH

24 May 2012RTTC, Nagpur55GSM THREE TYPES OF CONTROL CHANNELS Dedicated control channel DCCH P - P For Registration SDCCH ,authentication SACCH & Handover FACCH Broadcast control channel BCCH P- MP For Freq Correction FCCH For Syncronisation SCH BCCH Common control channel CCCH For ACCESS Management PCH RACH AGCH

24 May 2012RTTC, Nagpur56OPERATIONAL CONCEPTS IDLE MODE -- When MS is powered on (active) without being in dedicated mode MS stays continuously in touch with BS Listens to transmissions from BS to intercept Paging Messages ( for incoming calls) Monitors Radio Environment in order to evaluate Chl Quality & choose the most suitable BS Listens to BS to avail short message broadcast service

24 May 2012RTTC, Nagpur57OPERATIONAL CONCEPTS ACCESS PROCEDURE -- Access to system ( switch over from IDLE to DEDICATED Mode) MS indicates to BS that it needs a connection BS accepts the request & indicates which traffic CHL it may use For above purpose specific transmission is done over Common Channels

24 May 2012RTTC, Nagpur58OPERATIONAL CONCEPTS MOBILE O/G Call MS sends access over RACH System allocates SDCCH through AGCH Lastly TCH is assigned through SDCCH when a conversation can start Set up information exchanged over SDCCH ( Authentication , Measurement Reports, Power Control)

24 May 2012RTTC, Nagpur59OPERATIONAL CONCEPTS MOBILE I/C Call Paging to MS through PCH since MS is monitoring PAGCH MS responds by sending a page response over RACH Set up information exchanged over SDCCH ( Authentication, Call set-up messages , Power Control) As a result system allocates SDCCH to MS over AGCH Lastly TCH is allocated to mobile over SDCCH . Mobile starts conversation.

24 May 2012RTTC, Nagpur60OPERATIONAL CONCEPTS IDLE MODE IDLE MODE ACCESS PROCDURE DEDICATED MODE MS O/G Call MS I/C Call----FCCH---- SCH----BCCH----RACH----AGCH----SDCCH----TCH----PCH----RACH----AGCH----SDCCH----TCH

24 May 2012RTTC, Nagpur61SUMMARYGSM - RADIO INTERFACE

Radio Interface Frequency Bands & Specifications Multiple Access Method FDMA & TDMA Modulation Method FDMA /TDMA Frame Representation Logical Channels Traffic & Control Operational Concepts Other Salient Features of RF I/F- DTX, Time Alignment Diversity, Fr. Hopping, Power Control.24 May 2012RTTC, Nagpur62MOBILE COMMUNICATION THANKS !!

24 May 2012RTTC, Nagpur

GSMNetwork StructureGSM Service Area: Total area served by the combination of all member countries where a mobile can be served.PLMN Service Area:It is one N/W area. MSC Service Area:There can many MSC/VLR in one PLMN area.It is one Mobile Exch. Area.GMSC: All I/C calls for PLMN N/W will be routed through GMSC. In a GSM/PLMN N/W all mobile terminated calls will be routed to a Gateway MSC. Call connections between PLMNs , or to fixed N/Ws must be routed to a GMSC.The GMSC contains the Inter working functions to make these connections. Location AreaCells24 May 201263RTTC, Nagpur63LOCATION AREA:There are several LA in a MSC/VLR combination A LA is a part of the MSC/VLR service area in which a MS may move freely without updating location information to the MSC/VLR exchange that control the LA. Within a LA a paging message is broadcast in order to find the called mobile subs. LA can be identified by system using the LAI. CELL.A cell is an identity served by one BTS. The MS distinguishes between cells using the BASE STATION IDENTIFICATION CODE(BSIC) that the cell site broadcast over the air.24 May 201264RTTC, NagpurGSMRelation between areas in GSMLocation AreaCellArea served by a BTSLocation AreaMSC Service AreaPLMN Service AreaGSM Service Area24 May 201265RTTC, Nagpur65GSMSecurity ManagementFour basic security services provided by GSM Anonymity : TMSI AssignmentAuthenticationEncryption: PIN24 May 201266RTTC, Nagpur66ENCRIPTION/CIPHERINGTo encode the burst so that it can not be interpreted by any other device than the receiver. The ciphering algorithm in GSM is called A5 algorithm. It does not bits to burst, meaning that the I/P and O/P to the ciphering process is the same as the I/P: 456 bits per sec.24 May 201267RTTC, NagpurGSMEncryption ProcessEncryption ProcessKEYPlain TextCipher-text24 May 201268RTTC, Nagpur68Power

ClassMax. Peak PowerTolerance (dB)

Normal Extreme

120W

(43 dBm)+/- 2 +/- 2.5

2 8W

(39 dBm)+/- 2 +/- 2.5

3 5W

(37 dBm)+/- 2 +/- 2.5

4 2W

(33 dBm)+/- 2 +/- 2.5

5 0.8W

(29 dBm)+/- 2 +/- 2.5