GSM Architecture P

8/3/2019 GSM Architecture P

1/57

GSM Architecture


2/57

GSM

Various subsystems1. Network Subsystem includes the equipments

and functions related to end-to-end call.

2. Radio Subsystem includes the equipments andfunctions related to the management of theconnections on the radio path.

3. Operations and Maintenance subsystemincludes the operation and maintenance of GSMequipment for the radio and network interface.


3/57

Network Architecture

B

TS

MSC VLR

HLR

PSTNISDN

Data

Networks

(

Air interface

OSS

BTS

BTS

MSC VLR

BSC

BSC

1 MSC=16 BSC

1 BSC=1024 TRU

A Interface

A-bis interface

BSC:BASE STATION CONTROLLER, BTS: BASE TRANSRECEIVER STATION, OSS: OPERATION AND SUPPORT

SUBSYSTEM.ss


4/57

GSMNetwork Structure

GSM Service Area: Total area served by thecombination of all member countries where amobile can be served.

PLMN Service Area:It is one N/W area.

MSC Service Area:There can many MSC/VLR inone PLMN area.It is one Mobile Exch. Area.

GMSC: All I/C calls for PLMN N/W will berouted through GMSC. In a GSM/PLMN N/W allmobile terminated calls will be routed to aGateway MSC. Call connections betweenPLMNs , or to fixed N/Ws must be routed to a

GMSC.The GMSC contains the Inter workingfunctions to make these connections.

Location Area

Cells


5/57

LOCATION AREA:There are several LA in a MSC/VLR

combination A LA is a part of the MSC/VLR service area inwhich a MS may move freely without updating location

information to the MSC/VLR exchange that control the LA.

Within a LA a paging message is broadcast in order to find

the called mobile subs. LA can be identified by system usingthe LAI.

CELL.A cell is an identity served by one BTS. The MS

distinguishes between cells using the BASE STATION

IDENTIFICATION CODE(BSIC) that the cell site broadcastover the air.


6/57

GSMPLMN Service Area

V

MSC

MSC

MSC

MSC

VLR

VLR

VLR

I II

IVIII

I


7/57

GSM

MSC Service Area

MSC

VLRLA1

LA2

LA3

LA6

LA4

LA5


8/57

GSMCells

MSC

VLR

LA1

LA2

LA3

LA6LA4

LA5

C1C2 C3

C6C5

C4

C=CELL


9/57

GSM

Relation between areas in GSM

Location AreaCell

Area served by a BTS

Location AreaMSC Service AreaPLMN Service Area

GSM Service Area


10/57

GSM

LA CodingMCC

LAI

LACMNC

3 digit 3 digit 2 Octets

MCC:Mobile country code, MNC: Mobile N/W Code,

LAC: Location Area code


11/57

GSM

Functions of Mobile Station Voice and data transmission

Frequency and time synchronization

Monitoring of power and signal qualityof the surrounding cells

Provision of location updates even

during inactive state

Equalization of multi path distortions


12/57

GSM

Mobile Station

Portable, vehicle mounted, hand held

MS identified by unique IMEI(International Mobile EquipmentIdentity)

Shall display at least last ten received, dialledand missed calls

Minimum talk time of 1hr 30 min. andstandby time of 80 hrs

160 characters long SMS


13/57

GSM

Mobile Station - Power LevelsPower

Class

Max. Peak

Power

Tolerance (dB)

Normal Extreme

1 20W

(43 dBm)

+/- 2 +/- 2.5

2 8W

(39 dBm)

+/- 2 +/- 2.5

3 5W

(37 dBm)

+/- 2 +/- 2.5

4 2W

(33 dBm)

+/- 2 +/- 2.5

5 0.8W

(29 dBm)

+/- 2 +/- 2.5

Vehiclemounted


14/57

Mobile station Power adjustable in 2 db steps.down to 13

db(20mw) , under remote control from BTS .

BTS measure received power from MS (minimum) .

This is to minimize Co-channel Interference. Adjustmentwith 13 TDMA frame(60 ms).

The required power level is determined by BSC.


15/57

GSM

SIM Card SIM Module

Unique Subscribers ID IMSI and ISDN PIN( Personal Identification Number)

Key Ki( Identification Key) , Kc and A3,A5 and A8

algorithms SIM has CPU, ROM, RAM and EPROM


16/57

GSM

Mobile Identification Numbers IMEI

MSISDN

IMSI

TMSI

MSRN


17/57

GSM

MSISDN Mobile Subscribers ISDN Number The MSISDN is registered in the telephone directory and

used by the calling party for dialing.

MSISDN shall not exceed 15 digits.

NDS--National Significant Number---Give RoutingInformation to reach HLR

N(S)N--National Significant Number

CC NDC SN

1 to 3 digits Variable Variable

MSISDN : not more than 15 digits

N(S)N


18/57

GSM

IMSI International mobile subscribers

Identity

The IMSI is an unique identity which is usedinternationally and used within the network toidentify the mobile subscribers.

The IMSI is stored on the subscriber identitymodule (SIM), the HLR, VLR and ACdatabase.


19/57

GSM

IMSI 3 digits

MCC MNC MSIN

3 digits Not more than 9 digits

NMSI

IMSI : Not more than 15 digits

MCC--Mobile Country Code, MNC--Mobile N/W Code, MSIN--Mobile

Station Identification Number

NMSI--National Mobile Station Identity,assigned by Individual

Administration.

Mobile station Identification Number. It identifies the subs. In a PLMN.

First 3 digit identifies the Logical HLR-id of Mobile subs.


20/57

GSM, TMSI

Temporary Mobile subscribers Identity The TMSI is an identity which guarantees the integrity

of the mobile subscribers on the radio interface andprotect the Subs. from being identified by thoseattempting to monitor the Radio CHL.

The VLR assigns a TMSI to each mobile subscribersentering the VLR area.

Assigned only after successful authentication.

TMSI has only local significance i.e. within VLR & area

controlled by the VLR TMSI changes on location updation

TMSI is less than 8 digit


21/57

GSM

MSRNMobile Station Roaming Number

The MSRN is used in the GMSC to set up aconnection to the visited MSC/VLR.

MSRN--is a temporary identity which isassigned during the establishment of a call to aroaming subs.

CC NDS SN

CC--Country Code, NDC--National Destination Code, SN-- Subs. No.


22/57

GSM

IMEI International Mobile Equipment

Identity

The IMEI is an unique code allocated to eachmobile equipment. It is checked in the EIR.

IMEI check

White List Grey List

Black List


23/57

RADIO SUB SYSTEM (RSS)

n BTS n BTS

BSC

BSC

BSC

MSC/VLR

RSS

GSM


24/57

GSMFUNCTION OF BTS -I

Encodes, encrypts, multiplexes, modulatesand feeds the RF signals to the antenna

Transcoding and rate adaption Functionality

Time and frequency synchronisation signalstransmission.

11 power classes from .01 watts to 320watts

GSM


25/57

GSMFUNCTION OF BTS -II

Frequency hopping

Random access detection

Uplink radio channel measurements

BTS mainly consists of a set of transceivers(TRX).


26/57

FREQUENCY HOPPING

The Mobile Radio Channel is a Frequency selective Fading

channel, slow hopping freq. Of a CHL.changes with every

TDMA Frame. RATE--216.7 Hops/sec. It reduces the S/N

ratio.

Base Band Hoping: It involves hopping between freq. On

different transreceivers in a cell.

Synthesizer Hoping: Hopping from freq. To freq. On the

same transreceiver in a cell.


27/57

TIMING ADVANCE

ItIt IiIt is a solution to time alignment. It works by instructing the

mis aligned MS to transmit its burst earlier or later than it

normally would.

Transmission would occur earlier or later related to previousposition ,to reach its timeslot at the BTS in right time .

Max. bit times= 63. For 35 KM.

With extended range distances up 70 Km or even 121 Km canbe handled, using 2 T/S.


28/57

GSMFUNCTIONS OF BSC-I

It is connected to BTS and offloadsMSC

Radio resource management

Inter-cell handover

Reallocation of frequencies

Power control


29/57

GSMFUNCTIONS OF BSC-II

Time delay measurement of the receivedsignals from MS with respect to BTS clock.

Performs traffic concentration to reduce thenumber of lines from BSC to MSC.


30/57

GSM

MSC-BSS Configurations

BTSBTS

BTS

BTS BTS

BTS

A-bis

BSC

BSS

Configuration -6 Multi - cell site =multi--BTS site

Many singlecell sites

BSS

MSC

BTS

AA

A

Single - cell siteConfiguration -1

Multi - cell site (sector CellsConfiguration -5

MCC: Mobile Switching Centre

BSS: Base Station System

BSC: Base Station Controller

BTS: Base Transceiver Station

A-bis


31/57

Network and SwitchingSubsystem (NSS)

MSC

(PSTN)

VLR

HLR AUC

EIR

D

C

SS7 Signalling

Traffic Path

F

(BSS)

A

E

Other

MSC


32/57

GSM

MSC ( MOBILE SWITCHING CENTRE) Manages communication between GSM &

other network

Call setup functions, basic switching are done MSC takes into account the RR allocation in

addition to normal exchange functions

MSC does gateway function while its customers

roams to other network by using HLR /VLR


33/57

GSM

MSC Functions - I Paging, specifically call handling

Location updation

Handover management Billing for all subscribers based in its area

Reallocation of frequencies to BTSs in its area

to meet heavy demands


34/57

GSM

MSC Functions - II Echo canceller operation control

Signaling interface to databases like HLR, VLR.

Gateway to SMS between SMS centers andsubscribers

Handle interworking function while working asGMSC


35/57

INTERWORKING FUNCTION

-It provide the Interfacing Capability to Data N/Ws.

-IMF. A part of MSC, provides the subscriber with

access to data rate and protocol conversion facilities so

that data can be transmitted between GSM Data

Terminal Equipment ( DTE ) and a land line DTE.


36/57

GSMVISITOR LOCATION REGISTER (VLR)-I

It controls those mobiles roaming in its area.

VLR reduces the number of queries to HLR

One VLR may be incharge of one or more LA.

VLR is updated by HLR on entry of MS its area.

VLR assigns TMSI which keeps on changing.

IMSI detach and attach operation


37/57

GSM

Data in VLR IMSI & TMSI

MSISDN

MSRN. Location Area

Supplementary service parameters

MS category Authentication Key


38/57

GSM

Home Location Register(HLR)-I

Reference store for subscribers parameters,numbers, authentication & Encryption values.

Current subscriber status and associated VLR.

Both VLR and HLR can be implemented in the

same equipment in an MSC.

one PLMN may contain one or several HLR.


39/57

GSM

Home Location Register(HLR)-II Permanent data in HLR Data stored is changed only by man-machine.

IMSI, MS-ISDN number.

Category of MS ( whether pay phone or not )

Roaming restriction ( allowed or not ).

Supplementary services like call forwarding


40/57

GSM

Home Location Register(HLR)-III Temporary data in HLR The data changes from call to call & is dynamic

MSRN

RAND /SRES and Kc

VLR address , MSC address.

Messages waiting data used for SMS

GSM


41/57

GSMAUTHENTICATION CENTRE (AUC )-I

AUC is a separate entity and physicallyincluded in HLR

Protect against intruders in air interface

Authentication (Ki) and ciphering (Kc)key are stored in this data base.

Keys change randomly with each call

Keys are never transmitted to MS on air

Only calculated response are sent.


42/57

AUTHENTICATION & ENCRIPTION

AUC

Database

Generation

of RandomNumber

RANDRAND

IMSI1

IMSI3

IMSI2

ki1

ki2

ki3

RANDSRESKc

Algorithm forCiphering

A8

Algorithm for

Authentication

A3

Kc

64 bits

SRES32 bits

HLR


43/57

GSMEQUIPMENT IDENTITY REGISTER ( EIR )

This data base stores IMEI for all registeredmobile equipments and is unique to every ME.

Only one EIR per PLMN.

White list: IMEI, assigned to valid ME.

Black list: IMEI reported stolen Gray list: IMEI having problems like faulty

software, wrong make of equipment etc.


44/57

The centralized operation of the various units inthe system and functions needed to maintain thesubsystems.

Dynamic monitoring and controlling of thenetwork

Operations and Maintenance Centre

OMC

Functions Of OMC


45/57

functions-O&M data function

-Configuration management

--Fault report and alarm handling

-Performance supervision/management

-Storage of system software and data

Functions Of OMC


46/57

GSM

Security Management Four basic security services provided

by GSM

Anonymity : TMSI Assignment

Authentication

Encryption: PIN


47/57

ENCRIPTION/CIPHERING

To encode the burst so that it can not be

interpreted by any other device than the

receiver. The ciphering algorithm in GSM iscalled A5 algorithm. It does not bits to burst,

meaning that the I/P and O/P to the ciphering

process is the same as the I/P: 456 bits per sec.


48/57

GSM

Encryption Process

Encryption

Process

KEY

Plain Text

Cipher-text

M


49/57

MGeneric Authentication

Process

A3 A3

Ki KiRAND

RAND

CompareSRES

SRES

Response

IMSIIMSI

Yes/No

Radio Path

Authentication


50/57

Authentication is used to check the validity of amobile subscriber.

At MS At N/W

KiRAND( 128 bits )

Ki

A3 A3

SRES SRES

( 32 bits )=?

AUTHENTICATION


51/57

RAND ( 128 bits ):Random Number

SRES ( 32 bits) :Signed Response

Kc ( 64 bits ) : Ciphering Key

- Ki is stored in SIM and HLR.

Ki ( 128 bits) : Identification Key

- Purpose : Ki is used to calculate SRES and Kc.

- Ki is never transmitted over signalingnetwork.

- Purpose : Kc is used to encrypt data over radiointerface.

- Purpose : RAND is used to calculate SRES and Kc.

Ciphering


52/57

Ciphering is used to encrypt data on radio interface.

FrameNo. (22

bits )

A5

Information Bits ( 114 bits )

CIPHERING

Kc generation is done at thetime of Authentication.

RAND Ki

Kc ( 64 bits)

A8

Ciphering Stream

XORCiphered Bits

Authentication Procedure-I


53/57

1. To check identity provided by the MS.

The purpose of authentication procedure is two fold:

2. To supply n/w parameters to MS to calculate Kc.

Authentication procedure is always initiated andcontrolled by the n/w.

TIME

MS N/W

Authentication Request

Authentication Response

Authentication Reject

AUTHENTICATION PROCEDURE

Authentication done on each location update and for each new service.but not always,decided by


54/57

Authentication Procedure -II

-When to start Authentication ?

-N/W decides to initiate authentication in the following

scenarios:

A. If CKCN( Ciphering Key Seq. No.) in any initial messagefrom MS does not match with that stored at self end.

B. After some predetermined number of accesses to the N/W


55/57

Authentication Procedure-III

1. N/W initiates authentication by sending Authentication

Request message to the MS

2. Authentication Response by the MS

--MS calculates SRES and Kc after getting RAND fromAUTHENTICATION REQUEST MESSAGE .

-It stores Kc and CKSN (from message) into SIM.

-It sends SRES to the N/W.3.Authentication Response Processing at N/W

- N/W compares SRES received from MS and that stored at self

end.


56/57

Authentication Procedure

- If mismatch occures, N/W sends Authentication Rejectmessage to MS and cleans up all MM( Mobility & Management

) connections.

-If it matches then N/W proceeds for further activities.

4.Authentication Reject message at MS

- Ms sets update status in MS to ROAMING NOT

ALLOWED.

-deletes TMSI, LAI and CKSN from SIM.

-considers SIM as invalid until MS switched off or SIM

removed.

Authentication Procedure-V


57/57

- At n/w side, authentication procedure requires

authentication triplets.

Authentication Triplets :

-RAND ( 128 bits ).

- Authentication triplets contains

- SRES ( 32 bits ).- Kc ( 64 bits ).

- The network can have more than one triplets.

- The operator can allow reuse of triplets.

- The index of currently used triplet is called CKSN( Ciphering Key Sequence Number ).

Documents

GSM Architecture P